6/12/2014
Insider Threat
® Anyone with legitimate access to
information, technology, facilities, or
1 personnel
■ • Access is used to provide sensitive/classified
information to an unauthorized person
Or "
> Access is used to degrade operations or
capabilities
Who Are the Insiders?
m
- 1
® Over 4 million US clearance !
1 m ■ . I
holders .. ;;:y ->
® 860,000 have fop Secret '
Clearances - -
® 10.000 locations across the
u3
!• -
® How many people have access to
proprietary or restricted
information?
Categories of Threats
Ui ® Spills :
- Mishandling, careless, too much info on social
f 1 networking sites
• ! ® Leaks
I - Wiki, media, bloggers. Twitter, media friends
® Espionage
- Traditional spy
©Sabotage
- Cyber, physical damage, damage to the
ii- reputation •:
„ J&SS?
It Doesn’t Matter Where the Loss
Occurs . jllll
® Classified information could be
compromised at any location:
• Military installation
• US Government facilities
• Cleared Defense Contractors
• Research facility
• College/University
® “WikiLeaks”
■'r’Y/i&rS''-
? This Isn ’t Just a CfiRroblem
' ■ ■
Foreign governments, terrorist organizations,
organized crime rings, drug' cartels, etc., all want
to Know:
< Who is the EB1 Investigating? Cases
© Whal is the ESI doing? operations
v How does the FBI, do It? Methods
<* What can ttto EBJ do? CapabMiesfUmUations
<■• What does tho FBJ know?. Intelligence •
ft Who Is helping the FBI ? Sources
2
6/12/2014
Insider Threats Requires Team Effort ^
• ■ - 'ill
® Counterintelligence ;ssp« >sf^|
® Security ' ?
• IT Security 1
® HR
® General Counsel
® Risk Management (if applicable)
• • ■■ . 11 • ‘ < > .V 1 K*?>£
Why? -
y ' ..*"4 .
1. Divided Loyalty
2 . Disgruntled • :
111
3. Ego
• \ r ' v\:
4. Financial Gain
3
6/12/2014
4
6/12/2014
Espionage indicators (confd)
. 6. Bringing unauthorized recording devices
(thumb drives,' cameras, cell phones)
; . into work areas 'v - - fS-* ■
7. Unnecessary photocopying of classified
materials
8. Unexplained/Unreported foreign travel
9. Unreported foreign contacts
10. Unexplained affluence .. . '& .. .
; 11. Bragging ; about what they kno wMSiafl&l
5
6/12/2014
6
6/12/2014
Technology and Logistics
- mn
© Because of technological advances,
, ithe logistics of stealing information
* ■ have changed
• . • 64 gigabyte USB drive holds a semi
• truckload of pages (approx. 4 million pages
- of MS Word docs)
• ' No longer need to touch the information to
l^stealfcopy/photograghjp*
Sit.* lha riel/r r\f irl" noluinrl/p
mWM Imagine the risks of "cloud” networks
Why So Serious? g.y
® Why do Insiders pose such' a great risk?
• Access /S - .
• Quality or quantity
o Robert Hanssen vs. WikiLeaks
• They know what is most valuable
• IT Security looks for hacks/intrusions from
^iSIHide in plain sight
.. -
• . ft •
(T/F) Since this information is NOT classified
can share it with anyone. • x
(T/F) Because of where I work, I am a potential
target for Espionage/Economic Espionage?;
"ft ■ • §:
(T/F) He/she is here in the U.S., so it doesn’t is
matter if we talk about unclassified information;?;:)?
(T/F) Exports are always products
overseas.
7
6/12/2014
The FBI Recognizes That;
kSVjff'
^ vV'Vi
® Knowledge knows no
% boundaries ',
=4r-:. ■
® Global competition is
beneficial
® The flow of information is
Exports: Defined " X
® Transfer of Anything to a “Foreign Person”
or a fbreigntocation by anyftieans;;^
anytime^ anywhere, or a transfer'to a “U.S.
Person” when there is a knowledge that the
items will be given to a “Foreign Person”
a,. T
Export Controls
® Several types of export controls:
• Export Administration Regulations (EAR) - Dept.
;W: of Commerce: ifDual-use' -
-1; • !nternattop.a|ga||c in Arms RegulatiOi\S(ITAR)
- Dept.of State:' Defense articles.’seglces; etc.
• Arms Export Control Act ^ "
• International Emergency Economic Powers Act
(IEEPA)- Economic and trade sanctions
FunciamehtalResearah: Defined
&0M
mmm
® Basic and applied research in science and
engineering, the results of which ordinarily
are published and shared broadly within
the scientific community, as distinguished
from proprietary research and from
industrial development, design, production,
and product utilization, the results of which
ordinarily are restricted for proprietary or
national security reasons.
NSDD189
.1:
Fundameiit'al'Reseai'ch Exclusion M
•
® Does NOT apply if the language of the
contract:
• Forbids the participation of foreign persons;
• Gives the sponsor or the other party to the
agreement a right to approve publications resulting
from the research; or
• Otherwise operates to restrict participation in
research and/or access to ana disclosures :
research results;': ^
: ..//t. ■ p '-,s' - '
® Both basic and applied research can be
subject to export controls depending on the
funding source and other delineated
restrictions in place in a research cgntractWnK-
Better to- Be Safe
® Contact before sharing any information
that may be restricted, including:
• Security Office
• Export Control Office
Sharing includes: publications, emails,
presentations, conversations, transfers, or any other
exchanges of information '
® Export control is complex! Ask an expert.
• Protect yourself
• Protect your job
• Protect your country
8
6/12/2014
Penalties
® Failure to comply with U.S. export
.... control laws can result in severe
^penalties that can inclucle.the following:
; ^ -r‘ i.-
• Civil penalties up to $500,000 for each violation;
;VV" '
■ Criminal penalties up to $1 ,000,000 for each
Violation; and/or
• Imprisonment for up to 1 0 years
. T’ie,Chaige . .
® : :Setween’January 2004 and’May 2006, Roth and AG
1 engaged in a conspiracy to transmit export -controlled
; ' technical data related to a restricted U.S. Air Force i
contract to develop plasma actuators for a munitions-
: type UAV, or “drone,” to one or more foreign nationals,
including a citizen from the People's Republic of China,
Information = $
® “Because that’s where the money is." -
Willie Sutton on why he robbed banks.
• Information is the new currency
• You' are the new “banks’-
® Be thankful you are a target
• An organization with no information or ideas to
protect has no reason to exist
• Our information/ideas are what separate us from
our competitors
• And it gives YOU a job!
9
6/12/2014
When Traveling
<$> Don’t take anything you don’t need
• Information - including personal Information
• Electronic device* -'Smart phone* + foreign travel = dumb Idea
. • Extra credit cards
■ ■ * : ;
Assume that everything you take with you will be searched ,
All Information on computer*’ phone*,' electronic media, and in
L document* will be taken/copied ' v
; iSXpr’* ' Do not leave your thing* unattended: bag*, electronic device*, drinks
'S ’ Obey local laws/customs
• Don't get caught In a compromising positon
• ® Be wary of people you meet
-_,j •. International date line
' You have no expectation of privacy while there ^
Need to Know
® Each of us practice “need to know”
everyday in our private lives
... • Bank account numbers . -Vy
a
. i'.' '^Social security numbers .
.vii'M
® Make sure someone has a need to know
about your research before you share any
information with them
• Don't just take (heir word for it -*gfS
j
WtjgR&D?
, 'C'-' -‘Vj * * . , '■'*/$?&'’- ; •;
®; .Research and Development (RSD)^^> ■;
■ ..Expbnslve
• Time & labor Intensive
• ’Cutting edge*
• Biggest potential payoff - new technologies, markets
© Anywhere we have an advantage
• Not Just military technology
• . Could be anything from growing food to weather simulation to
advanced weapons
© Failures & dead ends U-y 2..
.f^ofjhe easy problems were solvedjong ago
• '•" '. ♦^That leaves the difficult problems * j§|Wfvsu£.
‘ y More dfficuh * mor* •xpenslv* . ^ '
13
6/12/2014
OPSvrs Strategic and Operational Plan 1
® In the interests of our national security., . .all
employees shall be: , "
v. £ Reliable "T ,
' : ^Trustworthy
• Of good conduct and character
<» Of complete and unswerving loyalty
to the United States
Adjudicative Guidelines .
® For Determining Eligibility for Access to
Classified Information (12/29/2005)
• Allegiance to the U.S.
: ^Foreign Influence/Preference .. .
• j»is"exual Behavior
• Personal Conduct
• Financial Considerations
• Alcohol Consumption/Drug Involvement
• Psychological Conditions
• Criminal Conduct
• Handling Protected Information
• O utside Activities
• Use of Information Technology Systems
15
6/12/2014
Drug involvement
<s> Roderick Ramsey (part of the Clyde Conrad spy
ring) recruited at least two other soldiers to
participate In espionage: . . ..
... ■ ' '*§$*<'
• ; :jho^cople‘thot I recruited, yes. they y/ere^^ ,
invbWe&Tn drugs, but it wasn't so much thaf they '-
were'pot’smokers or hashish smokers that made
them; in my opinion, moro susceptible to the " r • 4
pitch. It was that these were people who had.
already shown a propensity or willingness to
violate Army regulations.
Anyone In the Army who was willing to take ; ;
drugs on a regular basis has to be willing to take
some kind of risk and has 1o be svilling to break
the Army's regulations. That's the starting point
b7E
16
6/12/2014
b7E
^|§|
® Often will approach targets with lucrative t/5:
job offers overseas
• Consulting
^ • Private Investigations . . jjp.:#
T‘ • Security related '?« . '
blE
17
2014
1
pPM's Strategic and Operational Plan' { ||||
■ ® In the interests of our national'security....al
employees shall be:
• Reliable
• Trustworthy
• Of goodconduct and character
• Of complete and unswerving loyalty
to the United States
Jlfe" : '• : •'
r Factors 'oiConcem
® Extent of classified access
® Intelligence officer/foreign government
official contact
® Foreign.cbntacts and travel particularly if
!$■[ ■ unreported; • • ■'•’■S0V
® Furtive removal of classified material
m.
Your Mission: ,
Should you choose to accept it: w
® You will perform checks on more people
V*i*’’&*
Ft?
®. You will have less time ::
® You will be limited in the questions you can
l|i©eciypu^^
U are the 1 st Line of
^ I
I
I
-Wjfiat you can cfo,,..
® Get names in original language
® Finances (Determine if there are any issues)
• It is difficult to live/work overseas for years without a
foreign bank account
® Ask for details on foreign organizations, including:
■. • Name of organization in English and original language
Purpose of the organization
. S*. Membership in the organization -4'’
• • Foreign intelligence services often use organizations as
" cover, or for spoiling/assessing
® Follow up on foreign contacts (contact info)
• Includes: email contacts, social networking contacts, etc.
® Contact with foreign intelligence/police/security
• FIS often use police
(fyou suspect something, Flag it
18
.4
Glenn Shriver
v • . - ■ ■ , -
.. ' ® Studied in Shanghai - 2002-2003
;S' ; ®' Moved to PRC’-/esponded to ad
® Contacted by Chinese IOs
® Took DoS FSO exam twice/applied to CIA
® Guilty plea 10/2010 (Conspiracy to transmit NDI)
® 4 year sentence
® PRCEMB spokesman - The PRC states it “never
engages itself in activities that’ll harm other .
countries’ national interests, and it is sincere in
developing Sino-U.S. relations of mutual be
mmssal
UP
What are we currently seeing?
® More applicants from foreign countries
J : applying for IA or SA positions
• Applicants lived/worked overseas
®. Dates in applicationsflot matching
.:,®. Applicants marrying to gain citizenship e -
• ® Close family membersliving in a foreign
country ?
® Unreported foreign contacts
® Lack of verifiable information
HHHii
i
.9
-m
liSf 1
VS.Sffi — “
Ellery Systems
® Software company in Boulder, CO - 1994
• Andrew WANG (PRC) and Jing CUI (PRC)
' Stole Source Code
• Put Ellery Systems out of business, source code
ended up in China.
in the News
•
;,® Examples of Economic Espionage/Theft of
Trade Secrets:,:.; .J .
■ v
• Wen Chyu “David" Liu - Dow Chemical
• Michael Mitchell - DuPont
Meng Hong -DuPont
• Shalin Jhaveri- Bristol-Myers Squib
Hanjuan Jin -Motorola
. Sergey Aleynikov, Goldman Sachs]: sj/V
• David Lee- Valspar 'ft-
• Dongfan “Greg" Chung - Boeing
■■iM-
-
5
?are 4 d : Defense Contractor
ncerns
*■» : . %
ryC'V.*
m '
Thief vs. Competitor vs. Adversary <
fc T „. , . - Ml/:- --si!
t ® Thief: * M- . t * ■
SA-XJ-VM
ii
m
i: • Wants the money/materials that you have now
® Competitor:
m
r • Wants what you will have in the future
E\ © Market share, ■ ■ .
|a. v Jobs . & t •_ ' :
m
■ 5r*;
»> Money
1 ® Adversary
[ • Wants to take away your existence >
Techniques Used
. ® Social Engineering
|^® Trade Shows; vyJt;*
® Joint Ventures
® Unsolicited requests for information
® Acquisitions
® Unsolicited requests for research assistance
if--® International Conventions, Symposiums U •
® Trash * :
® Hacking
9
Take Responsibility
Cost of Doing Business
© Many companies view Eonnamin
fEspranaae as “the coei oj.fiolnij business’
© Know what is most fimportanlto your
nrganl-atlnn
* The rm'« irnponsm iniomtalts?' it, the fewer the
nwmtw-r at people that should fee access to it. 1
:JhVwatcofitfnHS*.[o irlaS^ajuu tfstirriiJu win
eafillEiU.S companies -ss Titus; than $1 Trillion
sar year
Eventually, the cost will be too great to bear
Then it will be too latet
• VtfHt ai „ your company’s strengths?
.. Tl in is what your competitors wilt be after.
ji .Thiwwno U* u> teoii anm Mnoiy acuMotfi^J w /ki«ui k
gSiion -SL'fatesJe&. for
afltsaitLons
Mitigating the Threat
Mitigating the Threat
© Education and training di workfarea
v Computer hspners. ant) NohrfliscIflsUre
4ftr*UTnpnt4 „
'V V< • tfiwM lUVA IriflMl I jltlLti which jt&n you JO
© High risk business activities:
* Foreign Operations
» Jbinl Vjtfenm with Pamlpn
*■ pc»wan Travel
• Tr'sde&icv*
-* 'Tjiiiho 1 , rely solely on these to protect you
*■ 'km get what you inspect, not what you expect
® System must utilize active alerts
© Don’t take what you don’t want “them” to
E
6/12/2014
Mitigating the Threat Travel
% Foreign travel ^athigh risk activity ' jfe
Require employees to notify company ofjfev
personal foreign travel •
• Provide threat briefings
• Ask tough questions:
e Will you be meeting anyone related to your work?
/ c Will you be conducting any speaking engagements—
■ formal or informal? - ' ,
‘ K : » Will you be taking any ihformation/materialsfrom work?
"‘Sr’"
M itigating the Th reat: Travel "
® Foreign travel - a high risk activity (cont’d)
• "Smart phonej-fc.foreign travel^ dumtlfflea .
* «>;>
• Prevent remote logging Into computer network
<1 Even a "secure* connection will be using foreign internet
connection
• Require any company laptops, phones, etc. to be
turned in while on travel
• Buy “stripped down” laptop/phones for employees to
use when on, foreign business travel.,^/
o Destroy hard drive after trip ' VS?
o Neverconnect to your network with these 'de
Mitigating the Threat "
® Identify “high risk” users:
• Significant foreign influence
« Financial hardship
• Underperforming (and advised as such)
• Facing administrative/disciplinary action
• Facing potential layoff or job termi natio
b7E
22
6/12/2014
: ‘, u> (it *1 : ,
^Section 81.1
tlpli Intelligence Authorization
;’ Vl Act of 1995 : f0 [
’e Head of each agency in
" * the Executive Branch
", ' shall ensure the FBI is
advised immediately of
^M|any informatioS^-is -
' ’ f indicating classified
information has/is being
i disclosed to a foreign
'i government without
“ authorization
Section 811
Responsibilities of other agencies
® Ensure FBI is consulted 'j .
regarding all subsequent actions^Vfl|
to determine the source of the
loss •
® Given complete and timely I aSSfll
access' to'agency employees ffgjLtS'
and records %
® Avoid alerting subjects to the
FBI investigation
Hill
Section 811
Responsibilities of the FBI :
j • FBI will ensure that information developed as a result
' of the investigation relating to: S' ;j _ ' -Sfei
I"? -;;- - Espionagelinformation relating to their personnel*'
' - Information on operations and risks • :
FBI will consult with the referring agency regarding the >
espionage investigation
Section 811 1
® Waiver %
® In extraordinary circumstances affecting vital
national security interests/the President may
waive the preceding requirements as they apply
to the head of a particular department of agency
b7E
23
6/12/2014
Section 811
- ® 811 does not : .
v ' apply to: '
• Media Leaks
• Security
Violations'
m i
i : i
l" -
Wlx
'Why is OOMSEC important?
A historical example of exploiting an enemy’s
communications
Thesetting: ■' V-s,'?-',
• May, 1942 in the Pacific '
• Japanese advance'since Pearl Harbor: «v
o Philippines 1
«> Malaya
w Singapore
e Dutch East Indies (Indonesia)
o Thailand
o Hong Kong
o Guam
rfco Wake Island
OOMINT m Action
® The U.S. broke Japan’s JN25 code and were
able to prevent Japan’s capture of Port
Moresby, New Guinea (Battle of Coral.Sea) in
early May‘‘$i?42. .
® U.S. discovered Japanese were planning
another attack on the U.S. at “AF” at the
beginning of June, 1942.
• Japan’s plan was to set a trap for the U.S. to lure the
aircraft carriers into reach
• if successful, (Japan would have total dominatja
the Pacificiu.,:-
The Plan /Y
, ® To determine where “AF’’ was, the U.S.
/ sent innocuous messages from various
locations to determine “AF” in the clear
ife . 'rfWS* ;
i®, Each possible location would send a .
T message with a unique problem at the
/ location. If the Japanese referred to any of
the problems as being at “AF”, it identify
their target
Where is AF”? Midway
® Midway Island sent fake
message that it had a
broken water distillation
plant, and toe island
needed fresh water
® Japanese sent coded
messages that “AF”
needs fresh water
24
6/12/2014
Communications Spies (cont’d)
Michael Allen -Navy »
' ChariesAnzalone- USMC' 'MM
Stephen Baba - Navy 1 1
Jeffrey Carney - Air Force/NSA h
James Hall III -Army
Joseph Helmich -Army
Eric Jenott-Army
Bruce Kearni- Navy
Francisco Mira - Air Force H
Frank Nesbitt - USMC/Air Forcef
Charles Slatten -Army
Henry Spade -Navy
Michael Tobias and Francis Pizzo
Worked at NS A
® David Boone -Army/NSA
'
® Jeffrey Carney -Air Force/NSA
® Robert Lipka - NSA
® Ronald Pelton - NSA
■
* Rad Acc^efs to a Cbae-Room
Michael Allen - Navy
Stephen Baba - Navy
Christopher Boyce - Contractor
Joseph Helmich -Army
Eric Jenott ,- Army *>:
Steven Lalas- Dept, of State ■ ■
Robert Lipka - NSA
Frank Nesbitt - USMC/Air Force
Charles Slatten - Army
Henry Spade - Navy
Michael Tobias - Navy
John Walker- Navy
Jerry Whitworth - Navy
■mve .Communication^ ■
Plans/Techniques ^
® ChariesAnzalone -USMC
® Christopher Boyce - Contractor
® Jeffrey Carney -Air Force/NSA
® James Hall III -Army
® Andrevy Lee - Civilian .
® Robert Lipka -NSA -'vi-
® Francisco Mira -Air Force
© Frank Nesbitt - USMC/Air Force
® Ronald Pelton - NSA
® Roderick Ramsay -Army
® John Walker- Navy
25
6/12/2014
Need to Know • . 3
:#p
® Each of us practice “need to know"
everyday in our private lives
• Bank account numbers
• Social security numbers
■ ft -■ ' :'?*a
® Make sure someone has a need to know
before you share any information with them
• Don't just take their word for it
mi
26
6/12/2014
28
FEDERAL BUREAU OF INVESTIGATION
FOI/PA
DELETED PAGE INFORMATION SHEET
FOI/PA# 1261025-0
Total
. Deleted
Page (s) =36
Page
4 ~
b5 ;
b7E ;
Page
5 ~
b5 ;
b 6 ; b7C; b7E;
Page
6 ~
b5 ;
b 6 ; b7C; b7E;
Page
7 ~
b5 ;
b7E ;
Page
8 ~
b5 ;
b 6 ; b7C; b7E;
Page
g ~
b5 ;
b7E ;
Page
10
~ b5 ;
b 6 ; b7C; b7E;
Page
11
~ b5 ;
b7E;
Page
12
~ b5 ;
b 6 ; b7C; b7E;
Page
13
~ b5 ;
b 6 ; b7C; b7D; b7E;
Page
14
- b5 ;
b 6 ; b7A; b7C; b7D;
b7E;
Page
15
~ b5 ;
b 6 ; b7A; b7C; b7D;
b7E ;
Page
16
~ b5 ;
b 6 ; b7A; b7C; b7D;
b7E;
Page
17
~ b5 ;
b7E;
Page
18
~ b5 ;
b 6 ; b7C; b7E;
Page
19
~ b5 ;
b7E;
Page
20
~ b5 ;
b 6 ; b7C; b7E;
Page
21
~ b5 ;
b7E;
Page
22
~ b5 ;
b 6 ; b7A; b7C; b7D;
b7E;
Page
23
~ b5 ;
b 6 ; b7A; b7C; b7D;
b7E;
Page
46
~ b5 ;
Page
50
~ b5 ;
b 6 ; b7C;
Page
106
~ Referral/Consult;
Page
107
~ Referral/Consult;
Page
108
~ Referral/Consult;
Page
109
~ Referral/Consult;
Page
117
~ Referral/Consult;
Page
118
~ Referral/Consult;
Page
187
~ b5
r
Page
191
~ b5
; b 6 ; b7C;
Page
204
~ Referral/Direct;
Page
205
~ Referral/Direct;
Page
418
~ Referral/Consult;
Page
419
~ Referral/Consult;
Page
443
~ Duplicate;
Page
444
~ Duplicate;
XXXXXXXXXXXXXXXXXXXXXXXX
X Deleted Page(s) X
X No Duplication Fee X
X For this Page X
XXXXXXXXXXXXXXXXXXXXXXXX
»l \ . A
, ■* tlf *
. I-A'fil •; j
• A**, i • { :-
.. >1 tMI »*
'it
. ••
«■*« »(At«C ; % f
. ;
s A .jr.
1 ; | spi;..
V,»
«. ".LAS..
ia sr ■*
- t A“AV > •
AV' Mi ,
•iA>* VUi
i*»t *"** \
V"!i * *"•*
'i'-v,
•i
V,
\if **Af 1 .
■it M,V*
.1 T-e;> e*Jl ,k ui
*: a
.1* w»»* A l, s.
*n "■
-t-t
•? t f i f .*« ■
,* * 5*3. v ' ,, \
United States Senate
( UMMITTtt ON I HR .11,/DICiAIO
WASHINGTON IK yOhh) «v/t>
December 17, 2013
VIA ELECTRONIC TRANSMISSION
The Honorable James B. Comey, Jr.
Director
Federal Bureau of Investigation
935 Pennsylvania Avenue, N.W.
Washington, DC 20535
Dear Director Comey:
On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation
(FBI) in which it indicated that it had collaborated with the Office of the Director of
National Intelligence (ODNI) on two training videos about the FBI’s National Insider
Threat Program. The videos, titled Betrayed and Game of Pawns, were developed
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National
Counterintelligence Executive (ONCIX). The FBI has also produced other insider throat
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and
Deterring an Insider Spy . 1
As I understand it, the National Insider Threat Program is the result of Executive
Order 13587, issued by President Obama in October 2011, which established an
interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX. 2 3 It also
directed Executive Branch departments and agencies to develop their own insider threat
programs. The President subsequently issued a Presidential Memorandum in
November 2012 transmitting the National Insider Threat Policy and setting forth
minimum standards for departmental and agency programs . 3
These efforts have subsequently received press attention, some of which has
focused on concerns about whether the program adequately protects whistleblowers.*
1 Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an
Insider Spy, http://www.fbi.gov/about-us/investigate/counterintelligence/insider_threat_brochure.
2 Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at
http://www.whitehouse.gov/hie-press-office/2011/10/07/executive-order-structural-reforms-improve-
security-classified-networks-.
3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive
Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-press-
office/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand.
* For example, Marisa Taylor and Jonathan S. Landay, “Obama’s crackdown views leaks as aiding enemies
of U.S.,” McClatchy (Jun. 20, 2013), available at
The Honorable James B. Comey, Jr.
December 17, 2013
Page 2 of 2
As you know, I strongly believe that whistleblowers play an important role in
safeguarding the federal government against waste, fraud, and abuse. You too stated in
your confirmation hearing that you believe whistleblowers are a critical element of a
functioning democracy. Their willingness to come forward contributes to improving
government operations. They often put themselves at risk of reprisal from their
employers, sometimes being demoted, reassigned, or fired as a result of their actions.
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal
employees may not be retaliated against for reporting waste, fraud, and abuse.s
Accordingly, some agencies have taken steps to prevent the insider threat
program from chilling whistleblower communications. For example, the Office of the
Inspector General for the Intelligence Community is developing training that integrates
whistleblowing into the agency processes, making the Intelligence Community
whistleblowing and insider threat programs mutually reinforcing.
In order to assess whether training materials on the National Insider Threat
Program provide adequate guidance on protecting whistleblowers, I respectfully request
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of
any other training materials regarding the National Insider Threat Program or any FBI-
specific' insider threat program. I would appreciate receiving these materials by January
14, 2014. I know that you consider transparency to be an important value, and I trust
that transparency on this issue will benefit both whistleblowers and our national
security.
Should you have any questions regarding this letter, please contac j
I b f my staff a| I
Sincerely,
Charles E. Grassley
Ranking Member
cc: The Honorable James R. Clapper
Director of National Intelligence
http://www.mcclatchydc.com/20i3/o6/20/i945i3/obamas-crackdown-views-leaks-as.html#.Uccy-
vmVHl.
s Presidential Policy Directive 19, The White House, October 10, 2012.
r'f a o«5Ti?Txm nv . MCTrr
imr «1- X O X - ,L'i O _L w-Aj'
REA SOS: 1 . 4 CO
DECLASSIFY GW: 12- 31-
DATE : 03-02-2016
FY 2012 Request to Congress
Overview
ALL ItlTCPllATiOT^qGWTAI
WHERE SHOWS OTHERWISE
flED
EXCEPT
FY 2012 Request
Return on Investment
• Insider Threat
remains the greatest
vulnerability to the
USG.
IRKIVlTKIlSKlIIl
o will acquire
ware and related
contractor support for initial audit
generation, collection, and
monitoring capabilities.
•This initiative would provide
useful analysis on insider threats
and can provide early warning
signs that can prevent the
development of such threats. In
addition the resources would allow
the FBI to share information with
the 1C.
Week of August 1-5 , 2011
AL:. FBI INFORMATION CONTAINED
HEREIN IS UNCLASSfpED
CATE 03-03-2016 3Y F 2 ?M4 5 K3S NS I C
Update d: A ug ust 5 , 201 1 (7:00 a.m.)
Date time Event
Monday,
August 1
Monday,
August 1
Tuesday,
August 2
FBI
Participa nt s
Other
Participants
Contact
9:30 a.m.
Senate Select Committee
on Intelligence Staff
Briefing I I
11:30 a.m.
9:30 a.m.
Staff Briefing-Senate
Homeland Security and
Governmental Affairs
Committee
Senate Select Committee
on Intelli gence Staf f
Briefing -|
Insider Threat Study [
Community Outreach
Efforts/Countering
Violent Extremism
(CVE)
Insider Threat
Investigations &
prevention coordinated
by CD
]
Security; SC Randy
Coleman-CD;
uq
N/A
DOJ/OLA:"
— r =
E
SC Randy Coleman
& others
DOJ: OU[
ICivil Ri ghtsf
J; crs
EOUSA/^
DOJ/OLA:
N/A
b6
b7C
DOJ/OLA
U.S. Department of Justice
Federal Bureau of Investigation
Washington, D.C. 20535-0001
December 31, 2013
Honorable Charles E. Grassley
Ranking Member
Committee on the Judiciary
United States Senate
Washington, DC 205 1 0
Dear Senator Grassley:
This responds to your letter to Director Comey dated December 17, 2013, in which you
requested copies of two training videos about the FBI's Insider Threat Program. The videos,
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are
enclosed and are considered law enforcement sensitive for official use only, so we would request
that you not disclose the videos further without contacting us.
If I can be of add itional assistance in this or any other matter, please feel free to contact
me at | |
Sincerely,
b6
hlC
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Enclosures
1 - Honorable Patrick J. Leahy
Chairman
Committee on the Judiciary
United States Senate
Washington, DC 205 1 0
1 - Honorable James R. Clapper
Director of National Intelligence
December 31, 2013
Honorable Charles E. Grassley
Ranking Member
Committee on the Judiciary
United States Senate
Washington, DC 20510
Dear Senator Grassley:
This responds to your letter to Director Comey dated December 17, 2013. in which you
requested copies of two training videos about the FBI's Insider Threat Program. The videos,
titled Betrayed and Game of Pawns, were developed jointly by the 'FBI's Counterintelligence
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are
enclosed and are considered law enforcement sensitive for official use only, so we would request
that you not disclose the videos further without contacting us.
If I can be of additio nal assistance in this or any other matter, please feel free to contact
me d ' ' ~1
Sincerely,
b6
b7C
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
rAn-Ato"’' 'Enclosures
1 AD-nVC'l
■ \l M nm.
' um'i's"' U - Honorable Patrick J. Leahy
"..' Chairman
i’jis" " ' Committee on the Judiciary
Cirimcll. . ,
ciitciwnsm”.. ].,uTYf tgd States Senate
cyb'^T 1 "' ; :;:i; Washington, DC 205 1 0
JIT*; T— ‘Honorable James R. Clapper
hn P<: iwi. n -Director of National Intelligence
Xj EBTExecSec, Room 6147 (TRIM # 13/DO/4459)
i m. ..nh'^CK^AD'Kelly
( hi .ii imcil.T;: MsrBeers
oil. I.’n'ml'lUp.GGA Member’s Folder
Kcc Mil int.
Security
Training
OIK ofli tO A MAIL ROOM □
U.S. Department of Justice
Federal Bureau of Investigation
Washington, D.C. 20535-0001
December 31, 2013
Honorable Charles E. Grassley
Ranking Member
Committee on the Judiciary
United States Senate
Washington, DC 20510
Dear Senator Grassley:
This responds to your letter to Director Comey dated December 17, 2013, in which you
requested copies of two training videos about the FBI's Insider Threat Program. The videos,
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are
enclosed and are considered law enforcement sensitive for official use only, so we would request
that you not disclose the videos further without contacting us.
If I can be of additional assistance in this or any other matter, please feel free to contact
me at) |
b6
Sincerely, b7 '
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Enclosures
1 - Honorable Patrick J. Leahy
Chairman
Committee on the Judiciary
United States Senate
Washington, DC 20510
1 - Honorable James R. Clapper
Director of National Intelligence
ALL INFORMATION CONTAINED
HEREIN IS UNCLASSIFIED
DATE 04-20—2016 BY F22M45K35 NSICG
December 31, 2013
Honorable Charles E. Grassley
Ranking Member
Committee on the Judiciary
United States Senate
Washington, DC 20510
Dear Senator Grassley:
This responds to your letter to Director Comey dated December 17, 2013, in which you
requested copies of two training videos about the FBI's Insider Threat Program. The videos,
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are
enclosed and are considered law enforcement sensitive for official use only, so we would request
that you not disclose the videos further without contacting us.
If I can be of add itional assistance in this or any other matter, please feel free to contact
me ad j
Sincerely,
b6
b7C
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
I’An-Ajm' 1 "' ’Enclosures
1 AD-CT/U
1 \l M mil,
! -1- - Honorable Patrick J. Leahy
itfr.: . Chairman
-\tlni. Sen*. _ ,
i-jis .J.' Committee on the Judiciary
C’triiucll. . . . - _
cmeimnsm ”” TlftSo States Senate
LyhV" Washington, DC 20510
& ’i'-Honerable James R. Clapper
-- -Director of National Intelligence
;**;jjr> XvEBCExecSec, Room 6147 (TRIM # 13/DO/4459)
on, ..rih^CfQ^D' Kelly
i 'iitirinioi'i.T - MsrB eers
oil; In'm'r'iWpOCA Member’s Folder
Ret Mg ml.
Security
Training __
on; of Leo a
MAIL ROOM □
Event Date: J”
6/6/2013
Congressional Affairs Office
Congressional Contacts
Classification Level:
Date
Entered:
06/10/2013
2013-280
"jetassified.
O Proactive
® Reactive
® Briefing O Hearing OSACCV OHQCV O FOC O Other
i U of SAC CV
Visits:
Brief Type: Member
Event. Date:
Entered By:
Topic: Insider Threat / Bo Jiang / Shane Todd
6/6/2013 Event Time:
Unit: jcLUI
Division:
12:30 PM
OCA Contact!
Person! - ’'"
DOJ Contact:
FBI
Participants:
Date: 16/6/2013 Attended: f
uci r
DAU VirtCSrtt LiSi
SC Mark Bartek
Other Participants:
none
Committees
/Subcommittees
House Appropriations Subcommittee on Commerce Justice Science and Related
Agencies(HAC CJS)
b6
b7C
Members/Staff: Rep. Frank Wolf, staffe
Executive Summary:
Insider Threat / | |
Details of Event:
On 06/06/2013 the FBI provided a classified briefing to Rep. Frank Wolf and staff: 11 Insider Threat program to
Follow Up Action:
none
Attachment:
b6
b7C
b6
b7C
b7E
0
Congressional Affairs Office
Congressional Contacts
Event Date: j 3/12/2014 classification Level:
p ate j 03/42/2014 1 2014-600 j
Entered: * *
Q Briefing O Hearing ( } SAC C V Q HQ C V O FOC
BriefType:
Unclassified
O Proactive O Reactive ;
® Other
i K of SAC cv
1 Visits:
Entered By: |
Event Date: j 3/12/201 4 Event Time:
Unit: jcLU II
' 1 I '
Topic: Acknowledgement from Grasslev slaffe l I that he did Division: |~
not respond to FBI’s offer more than a month ago for a briefing on I
■the matter of Insider Threat program, and request for a briefing.
OCA Contact
Person:
J
DOJ Contact:
FBI
Participants:
Other Participants:
Committees
/Subcommittees
Date:
Attended: J"
b6
b7C
Members/Staff: []
^Grassley staffer
Executive Summary:
I r e InsiderThreat program brieing
Details of Event:
Acknowledgement from Grassley staffel
ifAr At UrUfiAA AN- ILa --It — A - t ( 1 -J TL.
for a briefing on the matter of Insider Threat program. Agent
agreed. Will follow up with prospective date/time.
Follow Up Action:
hat he did not res pond to FBI’s offer more than a month ago
renewed the offer of a briefing.^
]
b6
b7C
b6
b7C
Attachment:
0
m
Congressional Affairs Office
Congressional Contacts
Event Date:
3/24/2014
Date 04/01/2014 1 20 14-6 12
Entered:
Classirication Level:
f"
Ftnnnifigrf _
O Proactive
® Reactive
O Briefing 0; Hearing 0 SAC CV C HQ CV Q FOC O Other
# of SAC CV
Brief Type: Member
Entered By: |
Event Date
* r
_ . ! Visits: '
3/24/2014 Event Time: 4:30 PM
Unit: CLUI
Topic: HPSC1 FY 2015 Bud 9 e *
Division: NSB
OCA Contact
Person:
DOJ Contact
: Jn/a ”
Date: 4/1/2014
Attended:
FBI
Participants:
EAD McCabe
Other Participants:
DHS-lo,[_
Committees
/Subcommittees
House Permanent Select Committee on Intelligence(HPSCI)
b6
b7C
b6
b7C
Members/Staff: Miller, King, Schiff, Rooney, Pompeo, Conaway, Nunes, Heck, Himes, Sewell, Bachman
Executive Summary:
Fiscal Year 201 5 HPSCI Member brief on FBI budget.
Details of Event:
The brief was held at a classification level that precludes most information discussed from being entered into this
log. Mr. Miller acted as Chair and opened the brief with positive remarks and praise for the FBI and a negative
opening statement regarding DHS-INA past performance. He primarily wanted to hear from FBI about the state of
■the Insider Threat Program and current levels of resources dedicated to Cyber matters. Mr. King left the Hearing
immediately following roll call and did not participate. Mr. Shiff mainly asked about FBI plans moving forward for
Insider Threat, cyber and surveillance matters, Mr. Conaway aske d about NSRP, surveillance capabilities, the FBI
1 I AII of his questions were answered with no get-
backs. 5r. Heck was curious about which areas the Bureau is wilting to accept risk, in light of decreasing budget.
No get-backs for Heck. Ms. Bachman's only questions were about FBI linguists and were answered to her apparent
satisfaction. No get-backs for Bachman. More details are included in the TS/SCI level IMS.
Follow Up Action:
For Mr. Miller- Are all FBI computers, both NIP and non-NIP, auditable? ! f idvised he would p rovide answ er
after confirming. For Mr. Schiff-Wants specific percentage of FBI CT work both before and after 9/1 1 .| 1
advised he would get actual numbers, ~
Attachment:
2
b7E
b6
b7C
HEREIN
DATS
IS UNCLASS IE I!
3-2016 3Y F22K45K35
Congressional Affairs Office
Congressional Contacts
Event Date: j 4/4/2014 Classification Level: JunCassified
j 05/29.2014 [ 20 14-698 [" Q Proactive O Reactive ■
1 (•) Briefing O Hearing C SACCV OHQCV O FOC O Other ) # of SAC CV ] J
i Visits: '
Brief Type: Event.Date: J~" 4/4/2014 " Event Time:
Entered By: | ~j Unit: jCLU il
Topic: Briefing for Grassiey staffers regarding FBI Insider Threat Program Division:
OCA Contact
Person:
DOJ Contact:
FBI
Participants:
Date
Attended:
ud
Other Participants:
Committees
/Subcommittees
b6
b7C
Members/Staff:
Executive Summary:
Briefing for Grassley staffers regarding FBI Insider Threat Program
Details of Event:
Briefi ng for Grassley s taffers regarding FBI Insider Threat Program. This briefing was coordinated in advance with
staffe j [ wh o request ed a briefing specifical ly on t he FBI Insider Threat program - no other topic v/as
proposed or request ed b l fr o be briefed. After UC ) I intro duced himself and noted his role among other
things as a l l of the Insider Threat task Force, staffer] [ _ opened with a remark that FBI videos did not
distinguish Insider Threat from whistleblowers. Agenf 1 Reminded staffers that FBI was there, per
I I reauest. to brief on Ihe topic of Insider Thre at Prog ram, and invited staffers lo ask questions regarding the
Insider Threat program, and noted to staffers that UC I I was not there to brief on matters regarding
whistlehlnwing Reference was made to a website that may provide guidance for propspective whistleblowers. UC
I h oled that, as far as he knew, if someone is a whistleblower then any investigation under Insider Threat is
suspended; he further noted that he v/as not asked or prepared to brief on whistleblowin g, and was ready, wil ling,
and able to to proceed with briefing on the matter of the Insider Threat program. Staffers ! l efused
to keep to the subjec t of Insider Tty i
whislleblowing, Agenj | again reminded staffersT
briefing on the Insider Threat program, and Age 1 4 | t real
eat program, and instead badgered exclusively for statements regarding
? ml “ ! that they had requesled-oahtioLaa
to the stall
- s the content I
email that requested a briefing only on the topic of Insider threat program. Agent I I
. that if th ey want a briefing in tile future on whistleblowing, then they should make that request. Staffers 1
I refused and continued their badgering wilh questions unrelated to the insider Threat program. Grassley
staffer!
,of staffeL
further told staffers
nd
Continued bad faith rendered the purpose of the instant briefing null, and FBI departed.
Follow Up Action:
Attachment:
2
b6
b7C
b6
b7C
DECI&SSI3TB0 BY : KSI~G F22M4BK33
UN 03-03-201'.
Congressional Affairs Office
Congressional Contacts
Event Date: j 3/24/201 1 Classification Level:
ClasGified -
Date 03/25/2011 ^ 12011-96
Entered: '
O Proactive
(.V Reactive
| ® Briefing - O Hearing Q SAC CV O HQ CV O FOC Q Other
# of SAC CV
Visits:
Brief Type:
Entered By:
Event Date: j~
3/24/201 1 Event Time;
Unit: jcLUI
Topic- Senate Appropriations/Commerce, Justice, Science subcommittee Division: Ffd
staff briefing, re: FY 201 2 Budget Rollout (dandified)- 1
OCA Contact
Person:
DOJ Contact:
FBI I DAD Janic e Lambert (FD)
Participants: ! lfFDi
f„. ^ , x °i
Other Participants:
N/A
Committees
/Subcommittees
Senate Appropriations Subcommittee on Commerce Justice Science and Related
Agencies(SAC CJS)
b6
b7C
Members/Staff: Siaf fl 1 (majority staff cierk-Sen. Mikulski)
I ^majority staff- Sen, Mikulski)
Executive Summary:
b6
b7C
Details of Event:
s^e^i worewr-
(U) SAC/Commerce, Justice and Science (CJS) subcommittee majority staffer ~l
were briefed on Ihe FBI's FY 2012 Budget request by FD's DAD and three FD/Budget staff.
(i^f^tThe briefing was very well received by the SAC/CJS staffers, The “get backs" from F D to (he staffers in clude
Ihe following: justification information on theconstruction base figures, including the shortfall |
construction cuts; a "cheat sheet" version of budget figures for Sen, Mikulski’s use; information on the "Insider
Threat" portion of the Foreign Intellige nce budget, i.e., is it a new initiative or included in the base funding figures; a
request for a demonstration of Ihe nev j t n unclassified version of
the PPT presentation used for the briefing; and, a request for a briefing on the proposed closure of several Resident
Agencies (RA's), as well as a map of the FBI's Field 0ffices.36gg6T/ M0r0RHr-
Follow Up Action:
1- Justification information on the construction base figures, including the shortfalls [ C onstruction cuts;
2- a "cheat sheet" version of budget figures for Sen. Mikulski’s use; information on the "Insider Threat" portion of the
Foreign Intelligence budget, i.e., is it a new initiative or included in Ihe base funding figures; 3- a request for a
demonstration of the ne| |4- an unclassified version of the PPT
presentation used forth! 5/ifetirt/j) Shd.b- a request tor a Briefing on me proposed closure of several Residenl
Agencies (FtA's), as well as a map of the FBI’s Field Offices.
Attachment:
b6
b7C
b7E
b7E
1
ALL INTORKATIOS COMTAIIEO
HEREIN IS OTJCLASSIEISB
HATE 03-03-2016 BY ~22:.:45K3S MS ICG
Congressional Affairs Office
Congressional Contacts
Event Date: j
j 05/27/2011
5/25/201 1
Classification Level:
Unclassified
Date
Entered
2011-244
O Proactive
'\J Reactive
] O Briefing O Hearing © SAC cv Q HQCV O FOC O QUier
it of SAC CV 1 Jq
Visits: *
Brief Type:
Event Date: j*"
Entered By: J
5/25/2011
Unit: jdU II
Event Time:
Topic: Boston SAC Richard DesLauriers Courtesy Visits - Day 2 of 2 Division: JT
b6
b7C
OCA Contact I
Person.
DOJ Contact;
FBI
Participants:
N/A
Boston SAC Richard DesLauriers
Other Participants:
Committees
/Subcommittees
Jhione
Date:
Attended:
Members/Staff:
Rep Michaud /D - 2nd MEjf"
‘ ~ :nfei
MA)(
Langevi n (D - 2nd W.
| t Rep Olver (6 - 1st MA)f
* ]Sen J Reed (RIF
Senatfl? AyotSS (NH)/['~
Sen Jolin Kerry (MA{
Executive Summary:
I; Rep Keating (D - 1 0th
” ioihMAlF I
I Rep Keating (D.
3 Sen Scott Brown (MAI
en Wh itehouse ( Rlli
|(D - 3rd MA|
b6
b7C
Details of Event:
SAC DesLauriers conducted co urtesy visits with the following Re presentatives. Senators and their corresponding
staff: Rep Michaud (D - 2nd ME 1 I Rep Keating <D - 10th MAVRarmti I
Senator Avotte (NHVSamantha R oberts & John La wrence: Rao Lannevin /r> - ?hrl Rivnavis Hake & Christopher
i Rep Keating (D - 10th M fl i Reo Olver (D - 1st Uif \ | Sen Scott Brown <MA)/
t en J, Reed fRli (San Whitehouse (Kl)/ 1 p en John
Kerry (MA I h Rep McGovern (D - 3rd MAI [ Rep Michaud requested that the
SAC consult with Maine’s US Attorney to review the State's report following an officer-involved shooting at a VA
hospital which resulted in the death of one of Rep Michaud's constituents (constituent’s family, also constituents, are
petitioning (or a federal review). It was fun to note that Rep Keating's office was once occupied by John F.
’Kennedy. Senator Ayotte was extremely supportive of the FBI and very knowledgeable about FBt-relaled issues
(such as the Patriot Act). She expressed strong support to help the FBI achieve its mission. She mentioned a visit
she had earlier in the day with an executive with Microsoft who explained to her that Microsoft has developed a new
imaging technology that could be used to combat child pornography. Microsoft would like to offer this software to
the federal government for free if th ey feel it could be h elpful. Sen Ayotle’s office provided th e following contac t
information at f^ir.rnsnfi for follow-up) [Microsoft Federal Government Affairs | |
fe microsoft.com. Ref) LaiKJUVI!! mentioned that his career aspiration as a young man before his
accident was to become an FBI Agent. His staffers had follow-up issues regarding Cyber threats and Cyber
security. Specifically mentioned was the recent Cyber IG report that was critical of the FBI, yet the staffers'
interaction with the private sector implied great confidence in the FBI's abilities to investigate intrusions. The other
staffe i I wanted to know what more the FBI is doing or could do to prevent future problems like
"Wikileaks". They requested a "get back" regardin g the National Insider Threat Program and SAC DesLauriers
mentioned tha t I miqht be good choices for that. Sen Whitehouse mentioned that
he will be sponsoring legislation with Sen Kyi addressing "Cyber Security Public Awareness" and wanted to know
more about what the FBI does in that arena. Sen Whitehouse’s biggest concern right now is that when someone
becomes a victim online (e-mail, internet, etc.) they don’t know where to turn for help. Sen Whitehouse wants to
make sure that the government has solutions to offer the public when they find themselves as online victims AND he
wards the. public to know (public awareness campaign) immediately where they should turn to find that help. All
visits were f riendly and
(D - 2nd MA|
pieasam. At/amnif rn
<D - Sth MA)
et up appointments
p- 1st ME),
t or saw uesLauriers wnn representatives Neat
? - 1st NH) and Senators Snowe (ME) and
b6
b7C
Congressional Affairs Office
Congressional Contacts
Shaheen (NH) were unsuccessful. Rep Frank (D - 4th MA) declined an invitation to meet with SAC DesLauriers in
'D.C. because they have met each other on several occasions previously.
Follow Up Action:
None.
Attachment:
fi
DECLASSIFIED BY: NS in
□N 03-03-2015
> 1 Congressional Affairs Office
Congressional Contacts
Event Date:
8/1/2011
Classification Level:
Entered
08/12/2011- J2011-341
O Proactive O Reactive
® Briefing Q Hearing O SAC CV O HQ CV O FOC O Other # of SAC cv
Visits:
Brief Type:
Entered By: f
To pj c; Insider Threat Study
Event Date:
8/1/2011 Event Time:
Unit: ICLUI
Division: ISECD
OCA Contact |
Person;!
DOJ Contact:
Date: *7/27/2011
Attended:
FBI UC|
Participants: I
I SC Patrick Reidy
Other Participants: -
/Subcommittees Senafe Select Committee on Intelligence(SSCI)
Members/Staff:
Executive Summary:
Details of Event:
(U) The brief was requested by staffej
Audit and Oversights Staff of the SSCT7
ps part of the Insider Threat Study being conducted by the
{U) UC I ~b rovided a comprehensive overview of the Enterprise Security Operations Center's (ESOC)programs
and capabilities of detecting and recording unauthorized access to the computer systems of the FBI. The programs
used and future plans for the ESOC to address the insider threat were discussed. Cooperation and interaction
within the FBI and the intelligence community were described.
Follow Up Action:
(U) Staff requested the Circular number for one OMB
circular regarding encryption
Attachment:
DECLASSIFIED BY: NSIiS F22K45K3*
GM 03-03-201^
Congressional Affairs Office
Congressional Contacts
£vent Date: ] 8/2/2011 Classification Level:
Date
Entered:
08/12/2011: ; 12011-340
clas si ne a"
O Proactive
O Reactive
(•? Briefing O Hearing O SAC CV O HQ CV Q FOC O Other
# of SAC CV
Visits:
Brief Type: Staff
Entered By: ]T~
Topic: lns id er Threat Study
Event
Date: J~
8/2/2011 Event Time:
Unit: jcLUI
Division: ]CD
OCA Contact
Person.*
DOJ Contact:
FBI
Participants:
SC Randall Coleman, ASCI
Other Participants:
None
Committees
/Subcommittees
Date: ] 7/27/20 11 Attended: 'J“
UC
Senate Select Committee on Intelligence(SSCI)
b6
b7C
Mornbers/Staff: [
Executive Summary:
b6
b7C
Details of Event:
Threat Study being conducted by the b 6
b7C
combating the insider threat problem,
both within the FBI and the intelligence community (IC)as a whole. He discussed the outreach and education
program including the use of the movie ’ Betrayed" and training programs. The cooperation between agencies in
prevention, deterrence and investigation was described. Coleman also detailed the CD’s role in carrying out
investigations of unauthorized disclosure and espionage throughout the 1C. The staff asked a variety of questions
relating to the topic.
Follow Up Action:
(U) Staff requested the statutory language relating to a S500.000 reward for information leading to arrests in counter
intelligence investigations. They also requested the working title to an Executive Order relating to Insider Threat.
Attachment:
(U) The brief was requested by staffer ! I as part of the Insider
]T, Audit and Oversights Staff of the SSCf.
^LSC Coleman outlined the Counter Intelligence Division’s (CD) approach to
0
A! L IpOBM^TION CONTAINED
HEREIN IS J8CLASSITIEO
DATE 03-03-2016: BY I22M45K35 fSICG
Congressional Affairs Office
Congressional Contacts
Event Date;
Date
Entered:
3/31/2011
Classification Level:
Unclassified
09/01/201-1. Jibll-
365
O Proactive
<•>
Reactive
! O Briefing O Hearing OSACCV OHQCV ® FOC O Other
# of SAC CV
Visits:
Division: IFD
Brief Type: Event Date: J 8/31/2011 Event Time:
Entered By: j BEERS, ELIZABETH^ ' Unit: J?0
Topic:
OCA Contact JbeE RS ELIZABETH
Person' ‘
I
Person:
DOJ Contact:
Date:
Attended:
FBI
Participants:
SAC Nancy McNamera
Other Participants:
None
Committees
/Subcommittees
Senate Appropriations Subcommittee on Commerce Justice Science and Related
Agencies(SAC CJS)
Members/Staff: [
Executive Summary:
b6
b7C
Details of Event:
Staffer requested support from Finance Division to stop by the MW FO during a scheduled visit to the state,
f fctaffs Sen. Johnson (R-WI) who sits o n our appropri ations subcommittee. SAC McNamera met with the
staner ana provided a backbrief to OCA. Overall ! t nessage was that the Senator is very supportive of
the FBI's mission and wants to restore any funds lhal the FBI is staled to lose. However, the Senator is atso
concerned about overlapping missions throughout the USG. in addition, he is interested in Cyber and whether is
USG is efficiently meeting that mission requirement. SAC McNamara highlighted three issues that she briefed: 1)
responding to Cyber concerns, SAC focused on the insider threat issue and everything that the FBI is doing to lock
down our systems and address vulnerabilities. She is going to talk with CD DAD Anderson about providing the
staffer with a copy of the movie "Betrayed" produced by CD. 2) SAC spoke specifically about cost savings
measures in MW-i.e. they've parked cars. She also talked about the RA closings and how, more than just saving
rent mo ney, it's abo ut gaining efficiencies via the consolidation. 3) Finally, they talked about HIDTA and the SAC
advised l t hat based on her experience in MW, it is an area where there may be some mission overlap.
She was clear to say lhal she didn't speak for the HIDTA program, but only about her experience in MW.
Follow Up Action:
•None.
Attachment:
2
Congressional Affairs Office
Congressional Contacts
Event Date:
11/16/2011
Classification Level:
Unclassified
Date
Entered
2011-479
1-1/17/201-1
i: >
[<$ Briefing O Hearing O SAC CV O HQ CV Q FOC
, O Proactive
o Reactive
Q Other # of SAC CV
J Visits:
Brief Type: Staff
Entered By: J
Event
Date: j*
H/16/2011 Event Time:
Unit: JdU II
Topic: Congressional staff visit to Defense Security Service . Division:
10:00 AM
OCA Contact £
Person: '
DOJ ContacJ_
T
Date: 11/10/2011
Attended:
FBI
Participants:
FBI-Phila; SAl
S/ \
T
Other Participants: p - .. .
j Defense Security Sen/ice staff; Center for Development of Security Excellence (CDSE)
Committees
/Subcommittees
Other
b6
b7C
Members/Staff: Staff for;
Sen. Chris Coons
Sen. Frank Lautenberg
Rep. Frank LoBiando
Executive Summary:
FBI Phila participated in a DSS presentation on insider threats and defensive briefing for govt contractors and
Congressional staffers.
Details of Event:
S/ I l and S/| (introduced FBI video "Betrayed", followed by slides about most significant threats to b6
information and sedulity lacerfby government contractors and personnel.
Follow Up Action:
None
Attachment:
1
ALL FBI INFORMATION CONTAINED
SEREIN IS UNCL A SSIFIED
CQ CONGRESSIONAL TRANSCRIPTS DATE 03-03-2016 by zaawsKss
Congressional Hearings
Feb. 10, 2011 - Final
House Select Intelligence Committee Holds Hearing on
Worldwide Threats
ROGERS:
- We'll call the committee and we'll come to order.
I want to welcome Director Clapper and our other witnesses this morning. They are very busy
people.
And I appreciate you all taking the time today away from that important work from your
agencies to participate in today's hearing.
Please pass along our thanks and appreciation to the men and women in your agency for their
commitment and dedication in the defense of the United States. We are eternally grateful for
their sacrifices.
I also want to welcome Dutch Ruppersberger as the committee's new ranking member. He is a
solid leader. His dedication and talent will serve the committee and country well.
Dutch is also a friend, and I look forward to working with him to foster the strong bipartisan
energy that we're going to need to lead this committee to our oversight responsibilities and to
keep America safe. And of course it never hurts to have a former prosecutor on your side.
I'm looking forward to the discussion of threats in the witnesses' statements this morning, and the
questions and answers that follow.
Before we get to that, I want to talk a moment about where I would like the committee to go in
the new Congress. And we've had the opportunity to talk with each of you about that direction,
from reasserting oversight to taking a strong evaluation of the 1 0 years where the budget has
grown exponentially and changed significantly; the budget, cyber issues, leaks and many others.
On reasserting oversight, it's a profound honor and a tremendous responsibility to assume the
role of the HPSCI chairman in such an important juncture in our nation's history.
The U.S. intelligence community is vital to defending our nation from many threats that we face.
I have no doubt that the hard work of our intelligence professional is one of the primary reasons
there has not been a successful major attack in the homeland since 9/1 1, despite numerous failed
and disrupted plots and A1 Qaida's unrelenting efforts to attack the United States.
I don't believe it's been deployed on every node., but I will get back to you on that for the record,
sir,
LANGEVIN:
Director Mueller?
MUELLER:
I would say that what has been in place for a couple of years it called the National Cyber
Investigative Joint Task Force, is a hub of identifying an early — attributing attacks, big, larger or
small. You have all of the relevant agencies there and the expertise and the tie-in into the
relevant agencies.
If it — if it turns out to be an attack by your -- your high school student down the street, then we
obviously would take it'd be a crime. More particularly that, it goes to the question of stopping
an attack, depending on the — from whence the attack originates, you would have people at the
table there who have the capability of doing it. If it originates overseas, certainly NSA, CIA, and
others. If it originates in the United States, we would have jurisdiction. If it comes to the — in
putting a wall on between the attackers and particular entities within the United States, DHS
would have a role.
But we have a focal point that identifies immediately the attack and then immediately tries to
deterring the focus of that — that attack and utilize all of the capabilities we have to address it,
regardless of whether it's in the intelligence side or the — or the law enforcement side.
LANGEVIN;
Let me turn quickly to some of the things we're talking about, especially with respect to
protecting dot-mil and — and — and dot-gov, our perimeter defenses. What is our level of
progress in being able to protect against — and dealing with the insider threat, as it relates to
cyber?
f
CLAPPER:
Well, that's -- that is — that issue has — has come to the fore and been reaffirmed by the
WikiLeaks disclosures. And certainly within the intelligence community, at least, we — we have,
I think, a strategy and embarked on an improvement program to attend to the insider threat,
whether it's WikiLeaks or any — any sort of insider threat through better identification of people
who are on networks, controlling movable media, and most importantly — and this applies for —
to several purposes -- auditing and monitoring.
And we're -- our progress is uneven to this point. And we've embarked on a campaign to — to
police that up, particularly within the intelligence enterprise.
IMKJBKATIQH CCNTAItSED
HEPFTM IS UNCLASSIFIED
DATE 04-20-2016 BY™ F22!.rf 5K35 IIS ICC
..*,’’* 1 * k i rAir* . } t-v.f
*v- 1| \ . .
* AH.l* } »« :f,i| ?> ’:f
nAH( , ^.-m 4 *{ 4r , ;« 1 ‘
*- •{ , * s * «' /. ,v *<it. iia,
AV * v i > »•, , ♦*»%>' \
-f »nA«VNl\ MiAM M>: n
. * ■* - >b Fy I »: A Ut »\> »t i»« A A* L
A*»! it. i Ml V'lA >. ■ rf»M •
V... * • ••’A A s
. i‘<V;i.r i i •) .* * -w..
\ i’ ! > ‘ , » » *•
v.umasj / i' ;<.v»
rr?,*.fi » * ' r ' v*
, “ > ■ *tt }!/,•* ,v > .*•» * » »((»;* ■ jf,
lilnitcd States Senate
t < iM.ViTTffc ON i HI-. JUfJICiAIO
WASHIMlHON iX VOhli) ti'.Ol.
December 17, 2013
VIA ELECTRONIC TRANSMISSION
The Honorable James B. Comey, Jr.
Director
Federal Bureau of Investigation
935 Pennsylvania Avenue, N.W.
Washington, DC 20535
Dear Director Comey:
On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation
(FBI) in which it indicated that it had collaborated with the Office of the Director of
National Intelligence (ODNI) on two training videos about the FBI’s National Insider
Threat Program. The videos, titled Betrayed and Game of Pawns, were developed
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National
Counterintelligence Executive (ONCIX). The FBI has also produced other insider threat
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and
Deterring an Insider Spy. 1
As I understand it, the National Insider Threat Program is the result of Executive
Order 13587, issued by President Obama in October 2011, which established an
interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX. 2 3 It also
directed Executive Branch departments and agencies to develop their own insider threat
programs. The President subsequently issued a Presidential Memorandum in
November 2012 transmitting the National Insider Threat Policy and setting forth
minimum standards for departmental and agency programs .3
These efforts have subsequently received press attention, some of which has
focused on concerns about whether the program adequately protects whistleblowers.^
1 Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an
Insider Spy, http://wwv.fbi.gov/ about-us/investigate/countermtelligence/insider_threat_brochure.
2 Executive Order 13587 - Structural' Reforms to Improve the Security of Classified Networks and the
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at
http://www.whitehouse.gov/the-press-office/20il/io/07/executive-order-structural-reforms-improve-
security-classified-networks-.
3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive
Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-press-
office/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand.
-« For example, Marisa Taylor and Jonathan S. Landay, “Obama’s crackdown views leaks as aiding enemies
of U.S.,” McClatchy (Jun. 20, 2013), available at
The Honorable James B, Comey, Jr.
December 17, 2013
Page 2 of 2
As you know, I strongly believe that whistleblowers play an important role in
safeguarding the federal government against waste, fraud, and abuse. You too stated in
your confirmation hearing that you believe whistleblowers are a critical element of a
functioning democracy. Their willingness to come forward contributes to improving
government operations. They often put themselves at risk of reprisal from their
employers, sometimes being demoted, reassigned, or fired as a result of their actions.
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal
employees may not be retaliated against for reporting waste, fraud, and abuse. s
Accordingly, some agencies have taken steps to prevent the insider threat
program from chilling whistleblower communications. For example, the Office of the
Inspector General for the Intelligence Community is developing training that integrates
whistleblowing into the agency processes, making the Intelligence Community"
whistleblowing and insider threat programs mutually reinforcing.
In order to assess whether training materials on the National Insider Threat
Program provide adequate guidance on protecting whistleblowers, I respectfully request
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of ■
any other training materials regarding the National Insider Threat Program or any FBI-
specific insider threat program. I would appreciate receiving these materials by Januaiy
14, 2014. I know that you consider transparency to be an important value, and I trust
that transparency on this issue will benefit both whistleblowers and our national
security.
Should you h ave any questions r egarding this letter, please contact]
[of my staff at| |
b6
b 7 C
Sincerely,
S'
Charles E. Grassley
Ranking Member
cc: The Honorable James R, Clapper
Director of National Intelligence
http://www.mcdatchydc,<x>m/2oi3/o6/2o/i945i3/obamas-crackdown-views-leaks-as.htm]#.Uccy~
vmVHl.
5 Presidential Policy Directive 19, The White House, October 10, 2012.
aECRETZ/NOPORN
CLASSIFIED 3Y: NSIC-; F22M45K35
REASON: 1.4 id
BECLASSI F¥ ON: 12-31-2036
DATE: 03-14-2016
ALL INFCRiATICW CONTAINED
HE r- 6IH IS UMCIASSIJISD EXCEPT
WHERE SHOWN OTHERWISE
Responses of the Federal Bureau of Investigation
to Questions for the Record
Arising from the April 14, 2011, Hearing Before the
House Permanent Select Committee on Intelligence
Regarding the FBI’s Fiscal Year 2012 National Intelligence Program Budget
Questions Posed by Chairman Rogers
1. How much does a surveillance team cost? Please provide the costs of various sized
teams and armed vs. unarmed teams?
Response :
In Fiscal Year 201 1 it costs appro ximate!
armed surveillance team and approximately
unarmed surveillance team.
to establish a new
27 During the hearing
to establish a new
J — I
jstated that the FBI can currently surveij [targets on a
b7E
bl
b3
24x7 basis. What is the FBI’s goal for the number of targets it is able to cover on a 24x7 bg
basis? How many additional positions and how much additional funding would be b7c
required to meet this goal?
Response :
m — -
present, the FBI is capable of covering targets on a 24/7 basis. Our
goal is to build a national surveillance capacity to provide for additional coverage.
bl
b3
3. The FBI requested no enhancements in FY 2012 for linguists. How does FBI plan to
handle the increasing volume of documents that requires translation?
Response :
(U) The demands on the FBI’s Foreign Language Program (FLP) fluctuate and
priorities are adjusted frequently to meet the greatest need at any given time. The
SECRET//NOFORN
77f.?Nv re, spouse?- m\’ ct'neui <•< of" 22 ' ! /
A- 1
Eft
SECRET/, 'NOPOR f'f
IS)
bl
b3
b7E
b. Is the FBI giving sufficient attention to other counterintelligence threats?
How so?
Response:
i^TNjp^Because the FBI’s National Cl Strategy prioritizeC
]The FBI’s
with appropriate attention afforded to
bl
b3
b7E
J Tn additions
lall of which are addressed in the FBI’s
5. Last year, the FBI created | [ Regional Intelligence Groups (RIGs) to facilitate
cooperation among field offices in the same region.
b7E
a. What specific value-added have the RIGs provided?
Response :
SECRET//NOFORN
7"/,v\ - rc spat? cr u' <>/ ' f'/y
A - 4
The FBI continually recruits for all necessary languages, and attempts to address all
work possible. The chart provided as Enclosure A reflects the hiring in recent
years up to 12/3 1/06 in the critical counterterrorism languages. When the FBI
does not have the language resources for a particularly rare language, we work with
contractors and with the National Virtual Translation Center (NVTC) to address
those needs. In one situation, the FBI used Department of Defense (DoD)
contracts to provide cross-training for FBI Arabic linguists on an unusual dialect of
Arabic that was needed. These resources provide a surge capacity in the FBI=s
most critically needed languages as well as a pool of linguists in less commonly
needed languages that are important to the FBI=s mission. Contract linguists must
pass the same language test batteries and security vetting as full-time employees.
Their Top Secret clearances, native-level proficiency in the foreign language,
high-level of skill in English, and knowledge of the target culture make FBI
contract linguists a highly desirable commodity in the IC. Many of the FBI=s
contract linguists provide support in languages that the full-time linguist staff does
not cover. The FBI depends on the contract linguists and NVTC for a substantial
amount of the needed support in many languages critical to the FBI=s mission.
While the FBI continues to hire new contract linguists, it is currently converting
many of the talented contract linguists hired since 9/1 1/01 to full-time language
analysts, with the goal of maintaining a language workforce composed of one-third
contract linguists and two-thirds FBI language analysts. This ratio will enable the
FBI to maintain a stable workforce and will provide greater job security and
benefits for the linguists proficient in the languages most needed to meet ongoing
national security requirements.
Since May 2006, the FBI has made a special effort to focus on the backlog and has
decreased the unaddressed counterterrorism work in the most critical languages to
less than 1,000 hours. While the figures referenced in the May 2006 hearing
pertain to counterterrorism cases only, audio backlog continues to be a concern for
the FBI. In general, audio collection in the difficult and unusual languages
represents only about 1% of the FBI=s total audio collection in the past four years.
WHISTLEBLOWERS
17. Whistleblower Mike German has alleged that the FBI failed to investigate a potential
terrorist link between white supremacist and Islamic extremists. During our investigation
of this case, our staff received two different versions of a crucial transcript. Neither version
of this transcript was complete.
These responses are cutrent as of 2/8/07
20
a. Can you explain the apparent discrepancies in the two versions of the
transcript?
Response :
In connection with its investigation of this matter, by letter dated 2/3/06 the
Committee requested from the DOJ OIG copies of documents the OIG relied upon
in preparing its reports. The document request included the transcript of the
1/23/02 tape-recorded meeting between members of the foreign and domestic
terrorist groups, which German had provided to the OIG in February 2003, and any
other transcripts made of that meeting. By letter dated 7/27/06, the FBI provided
the Committee with copies of the FBI documents responsive to this request,
including copies of two transcripts of the 1/23/02 meeting.
One version of the transcript, identified with the text marking A037eb01 .t3 @ at the
top left of each page, was obtained from German on 2/12/03 during his interview by
investigators from DOJ=s OIG and FBI. German produced and referenced
portions of this transcript in support of information he provided in his signed,
sworn statement, and this version was attached to and made a permanent part of
German=s sworn statement. This version of the transcript is a rough draft of the
transcription of a consensually monitored conversation that occurred on 1/23/02; it
contains several instances of AunintelligibleO conversations on the recording and
abruptly ends on page 126. On page 49, the construction of this document changes
from a rough draft format to FBI FD-302a format, and continues sequentially but
displays the page number starting at 46. This AcombinationO document submitted
by German contains duplicative pages of the rough transcription and the FD-302a,
so that pages 46, 47, 48, and 49 are misnumbered yet sequential. It is unknown
why German provided to OIG and FBI interviewers only 126 pages of a total 167
pages or why this document has a combination of transcript formats.
The second version of the transcript, identified with the marking AFD-302a@ at the
top left of each page, represents the draft of the entire transcription in the official
FD-302a format. Because the header and footer on each page of an FD-302a
reduce the remaining printing surface, the pages of this FD-302a draft do not line
up exactly with the pages of the rough draft portion of the version obtained from
German. In the FD-302a draft, many, though not all, of the Aunintelligible@
portions that appear in the rough draft have been clarified. This FD-302a version
is a complete transcription of the 1/23/02 conversation at 167 pages, or 31 pages
more than the version provided by German.
These responses are current as of 2/8/07
21
b. Which of the two transcripts do you consider most accurate?
Response:
For the reasons discussed above, the version identified with the FD-302a marking
at the top left of each page is the most accurate.
c. Will you provide the committee with the tape that this transcript is based
on, in its complete form? If not, why not?
Response :
The Committee has not previously requested a copy of the tape in connection with
its oversight investigation of this matter. Should we receive a Committee
oversight request from the Chairman regarding this matter, we would be pleased to
consult with DOJ as to the appropriate response.
Questions Posed by Senator Grassley
AMERITHRAX INVESTIGATION
18. a. Why was Richard Lambert removed as the head of the Amerithrax
investigation?
Response :
Richard Lambert served as the Inspector in Charge of the Amerithrax investigation
from 9/20/02 to 9/1 6/06. On 5/22/06, he applied for promotion to the position of
Special Agent in Charge (SAC) of the FBI's Knoxville Division. The Senior
Executive Career Board reviewed the qualifications of the interested candidates
and recommended Richard Lambert for selection. On 6/16/06, Director Mueller
announced the selection of Mr. Lambert as the Knoxville SAC.
b. Was it related in any way to disagreements between him and others
working on the investigation about the proper scope and focus of the FBI=s inquiry? If so,
please explain.
Response :
Mr. Lambert applied for and was selected as Knoxville SAC based on his
qualifications for the position.
These responses are current as of 2/8/07 .
22
and effectively collecting, sorting, and examining relevant data, the FBI will be
able to rapidly identify indicators of misuse and other inappropriate activity.
Along with these techno logy- driven innovations, the FBI will continue to use
regular personnel reinvestigations, including reviews of employees= financial
circumstances, to detect willful and/or potentially criminal misconduct.
d. What guidelines and training govern how agents deal with potential
informants who may be engaged in trading or short-selling securities or may be selling
information to hedge funds?
Response:
The FBI has instituted a new comprehensive informant validation process for use
by field offices and FBIHQ. The validation process includes quarterly SSA
reports addressing the sources= motivation, access, timeliness, corroboration, and
history. As discussed above, AG Guidelines address unauthorized criminal
activity by confidential sources. These AG Guidelines are covered in the New
Agent core-training received at the FBI Academy and reinforced through regular
legal training provided in field offices during the remainder of an S A=s career.
e. In October of this year, a former FBI agent Jeffrey A. Royer was
sentenced to six years in prison for racketeering and securities fraud. According to
witnesses at trial, the agent provided non-public FBI information to an outside party who
used the information to spread negative publicity about companies and profit from
short-selling their stock. What lessons can the FBI learn from this case?
Response :
In response to a recommendation in the March 2002 Webster Commission report,
the FBI's Security Division (SecD) developed and implemented a comprehensive
security awareness, education, and training program for all persons with access to
FBI information. This comprehensive approach included the development of a
professional cadre of highly trained Chief Security Officers, who now provide FBI
personnel with the most up-to-date security policy, training, lessons learned, and
best practices.
SecD uses a variety of educational methods, to include formal classroom training,
web-based training, written guidance, and mentoring, to enhance the security
awareness and education of the entire FBI population. Formal classroom
instruction has included: the authorized procedures for releasing information to
These responses are current as of 2/8/07
33
the public; refresher courses on establishing an information recipient=s
"need-to-know"; and the potential penalties for deviating from established
procedures. Instruction is also provided in the form of ANon-disclosure and
Releasability briefings, @ during which all personnel execute a "Classified
Information Non-disclosure Agreement" and "FBI Rules of Behavior" form
acknowledging their responsibility to protect and properly handle FBI information.
SecD also provides a host of additional training opportunities and materials, each of
which serves to reinforce security awareness throughout the FBI.
While this approach will not stop a trusted insider intent on disclosing information
for improper purposes, it ensures the employee is educated on proper ■information
handling techniques and encourages each employee to report others who violate the
rules. In other words, FBI employees now better understand their role in
protecting and ensuring the security of FBI information, personnel, and facilities.
f. What safeguards exist to prevent agents like Royer from similarly
profiting on non-public information about ongoing investigations?
Response :
Please see our responses to subparts c and e, above.
USE OF GOVERNMENT-OWNED OR LEASED AIRCRAFT
36. I understand that the FBI operates a number of executive jets as part of its aviation
program for both operational use and for official travel by senior FBI officials.
a. Please identify the number, type, and cost of aircraft owned and/or leased
by the FBI and used for both operational purposes and travel by senior FBI officials.
Response :
The FBI reads this question as distinguishing between aircraft used to meet
Amission requirements @ of the FBI and those used for the Aofficial travel® of
Asenior Federal officials® in the FBI other than to meet mission requirements, as
those terms are defined in OMB Circular No. A-126. 1 While the vast majority of
1 Paragraph 5 of OMB Circular No. A-126 (5/22/92) includes the following definitions:
b. Mission requirements means activities that constitute the
These responses are current as of 2/8/07
34
investigative files implicates significant individual privacy interests because these
files discuss allegations against individuals under investigation. DOJ has
consistently offered to accommodate Congressional requests for information about
OPR investigations through briefings, minimizing the intrusion on the privacy of
Executive Branch employees.
On 6/21/06 the FBI responded to the Committee's 5/10/06 request for information
and documents relating to the FBI's investigation of the suspected murder of
Assistant United States Attorney Jonathan Luna. In its response, the FBI advised
the Committee that documents concerning OPR matters raise serious privacy
considerations, particularly when, as in that instance, there was no finding of
misconduct. Consistent with the policy articulated above, Candice Will, AD of
the FBI's OPR, provided a 6/30/06 staff briefing that included an overview of
OPR's investigation and addressed both the issues raised in the Committee's
5/1 0/06 letter and all issues raised by the staff. In response to a question from staff
concerning the availability of the OPR report, our records reflect that AD Will did
not indicate that she had no objection to producing the report, but rather advised
that privacy concerns counseled against providing that document to the Committee,
FBI WHISTLEBLOWERS
42. In May, 2006, 1 asked the FBI for a description of each instance where an FBI
supervisor has been disciplined for retaliating against a whistleblower. Two weeks ago, I
received a response from your agency advising me that since 1999 no FBI supervisors have
been disciplined as a result of their having retaliated against whistleblowers.
a. Why haven=t any FBI supervisors been disciplined for having retaliated
against whistleblowers?
Response :
As the FBI has previously indicated in response to Questions for the Record, an
Assistant Special Agent in Charge (ASAC) was disciplined for whistleblower
retaliation. While that sanction, which was imposed before implementation of the
Bell Colwell recommendations, was ultimately vacated on appeal, that case does
not indicate that supervisors are not disciplined for retaliation, but instead indicates
that the FBI has procedures in place designed to protect the rights of all employees.
Since that response, no allegations of whistleblower retaliation have reached final
adjudication.
These responses are current as of 2/8/07
46
b. The DOJ/IG found that Jorge Martinez retaliated against Michael
German for protected whistle blowing activity. Has FBI disciplined Martinez? If not,
why not?
Response :
The FBI is well aware of this matter and is in the process of taking appropriate
action. Consistent with longstanding Executive Branch policy, our goal in all
cases is to satisfy legitimate oversight interests while protecting significant
Executive Branch confidentiality interests. As a general matter, the disclosure of
information from OPR investigative files implicates significant individual privacy
interests because these files discuss allegations against individuals under
investigation.
c. Since 1999, how many FBI personnel have claimed whistleblower status?
How many have claimed retaliation for protected whistleblowing activity?
Response :
The FBI is not in a position to provide this information. Pursuant to 5 U.S.C.
' 2303 and 28 C.F.R. Part 27, DOJ=s OIG and OPR serve as Investigative and/or
Conducting Offices in FBI whistleblower cases, while the Director of DOJ=s
Office of Attorney Recruitment and Management (OARM) is authorized to
adjudicate claims of FBI whistleblower reprisal and to order corrective action
subject to appeal to the Deputy Attorney General (DAG). Pursuant to 28
C.F.R. ' 27.4, the identity of employees who make those claims is not disclosed to
the FBI unless there is a recommendation for corrective action.
DOJ=s OARM advises that, based on numbers collectively reported by OARM,
OIG, and OPR for calendar years 1999 through 200.6, 96 FBI personnel have made
, allegations of retaliation for claimed protected whistleblowing activity. It is the
FBI=s understanding that there is no formalized consolidated record of those who
may initially claim whistleblower status because, in the absence of subsequent
retaliation based on the whistleblowing, the mere status as a whistleblower does not
affect the employees= rights or benefits.
REPORTING OF DRUG SEIZURE STATISTICS
43. The staff of the House Committee on Homeland Security, Subcommittee on
Investigations, recently released a staff report entitled, AA Line in the Sand: Confronting
the Threat at the Southwest Border.© This report describes, among other things, the
These responses are current as of 2/8/07
47
NICS developers are receiving daily system logs for further analysis. In addition,
the FBI is working in the non-operational environment in an attempt to recreate the
outage, but to date these efforts have been unsuccessful.
Absent a clear indication of the cause of the outage, the only changes made to NICS
as a result of it have been an increase in the shared memory pool and Oracle
database cache, which appear to have resolved the issue. The FBI=s CJIS
Division will continue to monitor and analyze the NICS in order to prevent or
minimize future outages.
b. Does the FBI know how many gun sales were completed without
background checks while the system was down?
Response :
The outage on Sunday, 1 1/26/06, lasted 45 minutes, and the three outages on
Monday, 1 1/27/06, lasted 34 minutes, 1 hour 24 minutes, and 35 minutes. Even
with these outages, NICS processed 17,983 firearms transactions on Sunday
(1 1/26) and 29,867 on Monday (1 1/27). For comparison purposes, on the Sunday
and Monday after Thanksgiving in 2005, NICS processed 14,574 and 28,200
firearms transactions, respectively. The FBI has no reason to believe gun sales
were executed during the outage in violation of the legal requirements of the Brady
Handgun V iolence Prevention Act of 1 993 .
c. What is the FBI doing to make sure that this problem never happens
again?
Response :
The FBI=s CJIS Division has made all of the changes recommended by the
vendors. As indicated in response to subpart a, above, the problem has not
recurred, but the CJIS Division will continue to monitor the system and make any
corrections we identify.
MIKE GERMAN / WHISTLEBLOWERS
76. According to the Office of the Special Counsel (AOSC0), the average number of
whistleblowers who have filed complaints with the government has increased by 43% since
September 11, 2001. Yet, sadly, the number of whistleblowers who have filed reprisal
These responses are current as of 2/8/07
90
complaints with the OSC because their employers have retaliated against them for coming
forward has also increased by 21% during the same time period. For example, former FBI
special agent Michael German has said that his reputation and career were ruined after he
reported concerns about misconduct on the Bureau=s terrorism investigations to his
superiors. What is the Bureau doing to protect the rights of whistleblowers within the FBI
to come forward and disclose government fraud, waste and abuse?
Response :
Although the FBI can never completely eliminate an employee's fear of whistle
blower retaliation, factors likely to induce such fear can be reduced or eliminated.
The anonymous nature of inspection leadership surveys (which are conducted prior
to internal FBI inspections to assess management effectiveness), private interviews
with the inspection staff during these inspections, and executive managers who
promote the proper environment all help to reduce the fear of whistleblower
retaliation. If an employee nonetheless believes retaliation has occurred, this may
be reported to the Inspection Division's IIS or to DOJ's OIG or OPR. FBI
employees are also frequently reminded through FBI-wide emails and other
mechanisms that there is a procedure established under law (5 U.S.C. ' 2303) and
implemented by regulation (28 C.F.R. Part 27) that provides a formal avenue for an
employee to seek corrective action based on a personnel action taken in reprisal for
whistle blowing.
77. Many whistleblowers in the intelligence community are discouraged from coming
forward because intelligence agencies are exempted from the Whistleblower Protection Act.
Would you support legislation to extend whistleblower protections to national security
employees?
Response :
Congress specifically excluded the FBI and other IC agencies from the application
of 5 U.S.C. ' 2302 (the government-wide Whistleblower Protection Act) because
of the classified and sensitive nature of their work and the fact that any employee
may have access to such information. The legislative history indicates that the
exceptions for the FBI and the other specified agencies is tied to the intelligence
aspect of their missions. See H.R. Rep. 328, 101st Cong., 1989 WL 225002 (Leg.
Hist.). We support the Congressional reasoning that underpins these exceptions.
Congress has provided separate whistleblower protections for national security
employees through the IC Whistleblower Protection Act of 1998 (ICWPA). The
These responses are current as of 2/8/07
91
ICWPA provides that an employee may communicate "a complaint or information
with respect to an urgent concern" regarding intelligence activities to the
appropriate Inspector General (or designee) and thereafter, under specified
circumstances, "to Congress by contacting either or both of the intelligence
committees directly." Inspector General Act of 1978, 5 U.S.C. Appendix 3,
' ' 8H(a)(l) and (d).
ANTHRAX INVESTIGATION
78. The Bureau=s investigation into the 2001 anthrax attacks that killed 5, infected 17
others and terrified millions of Americans is now well into its fifth year. Many believe that
the investigation has gone very cold and no arrests have been made in the case.
a. What is the current status of the anthrax investigation?
b. Do you expect that criminal charges will be brought in the case and if so,
when?
c. You testified at the hearing that the FBI currently has 17 agents and 10
postal inspectors assigned to the anthrax investigation. Has the number of personnel
dedicated to the investigation changed? Will you consider increasing the number of agents
and investigators dedicated to this investigation?
d. How much money has the FBI spent on the anthrax investigation to date?
Response to subparts a through d :
Pursuant to the longstanding DOJ policy against disclosing non-public information
concerning pending law enforcement and litigation matters, we are unable to
provide a response at this time.
79. A frequent criticism of the anthrax investigation is that the FBI has made a number of
incorrect assumptions about the source of the anthrax and refused to heed outside expert
advice in the case. Will the Bureau be open to new theories about the case and more
receptive to outside expertise and criticism going forward?
Response :
Pursuant to the longstanding DOJ policy against disclosing non-public information
concerning pending law enforcement and litigation matters, we are unable to
provide a response at this time.
These responses are current as of 2/8/07
92
FBI SAs, the FIGs, FBIHQ, and DOJ will all have roles in measuring the value of a
source=s operation as well as managing the risks associated with using a human
source. Redundancy of review will be an intentional part of the validation process,
serving as a check and balance on human source activities, including authorized
and any possible unauthorized criminal activities. The EAD of the FBI=s NSB
has approved a draft of the Validation Manual, and the FBI is moving toward
implementation throughout the FBI,
116. Some critics argue that the FBI often allows agents involved in wrongdoing to quietly
retire. What are you doing to ensure future accountability, since most of the FBI
personnel responsible for the Leung security breach avoided negative consequences by
retiring? Do you believe that the penalties described in your colloquy with Senator
Grassley about the Woods allegations are consistent with the recommendations of the
Inspector General in the Leung affair? If so, why?
Response :
As stated above in response to question 93, in order to ensure the accountability of
agents who engage in wrongdoing and then attempt to quietly retire, the Director
amended FBI policy governing the administrative inquiry process so that,
notwithstanding the resignation or retirement of an employee, a disciplinary matter
is completed where necessary to protect the institutional interests of the FBI.
Obviously, any matters involving criminal allegations are pursued irrespective of
an employee's retirement or resignation.
117. In response to a written question from Senator Grassley after our last Oversight
hearing, you appear to acknowledge that no one has ever been disciplined for whistleblower
retaliation under the FBI=s guidelines. Is that accurate? Can you explain? What is
being done to ensure that FBI whistleblowers are being protected from retaliation?
Response :
That is not accurate. As stated above in response to question 42a, the FBI has
disciplined a number of employees for engaging in retaliatory behavior, including
whistleblower retaliation. OPR recently suspended one supervisor for 30 days for
engaging in retaliation against a whistleblower. Although not final, in another
disciplinary matter, OPR has proposed the dismissal of a supervisor for retaliating
against a whistleblower. In another, OPR imposed a 3-day suspension on a
supervisor who threatened to retaliate against a whistleblower.
These responses are current as of 2/8/07
124
118. You also noted that, in the one FBI case where a 3-day suspension Avas initially
imposed for whistleblower retaliation, that decision was later reversed, through an appellate
process that the FBI=s General Counsel declared to beAflawed.@ What has been done to
fix the appellate process?
Response :
Upon the completion of the Bell/Colwell Commission's study of the FBI's
disciplinary process, the FBI adopted changes recommended by the Commission to
improve the FBI's disciplinary process. With respect to the FBI's appellate
process specifically, the Commission recommended key changes designed to
improve the transparency and fundamental fairness of the appellate process for all
FBI employees. These changes were adopted and made effective by the FBI
Director on 8/19/05.
One such improvement offers non-SES employees the option to choose a mid-level
manager, rather than an SES employee, to participate on the three-member
Disciplinary Review Board (DRB), which convenes to hear appeals in those cases
in which an adverse disciplinary sanction has been imposed by the FBI's OPR.
(Previously, the voting members of the DRB's were composed strictly of SES
employees.) The advantage of this change is that non-SES employees are now
being judged with input from "one of their own." This concept is especially
important in light of past OIG investigations into allegations of disparate treatment
in the FBI's disciplinary process.
Another important change, reconnnended by the Commission and adopted by the
FBI Director, was elimination of the ability to increase a disciplinary penalty on
appeal. This change was made to ensure all employees could take full advantage
of the FBI's appellate process without fear of facing additional sanctions. In
addition, the Commission recommended that the "de novo" appellate standard be
replaced with a "substantial evidence" standard, which is now being used to review
matters on appeal. This change allows the FBI's appellate authority to continue to
serve as an important check and balance on the entire OPR process.
In addition to the improvements mentioned above, the FBI's appellate authority
will continue to seek the advice of the FBI's OGC when guidance is needed on legal
matters. The FBI is dedicated to ensuring the FBI's appellate process continues to
operate in a fair, effective, and efficient manner for all employees.
Background: In response to questions following the last FBI Oversight hearing about press
reports relating to the New York Field Office, you seem to acknowledge that there may be
These responses are current as of 2/8/07
125
United States Senate
January 28, 2014
The Honorable Eric Holder
Office of the Attorney General
U.S. Department of Justice
950 Pennsylvania Avenue, NW
Washington, DC 20530-0001
Dear Attorney General Holder:
It has now been over 15 months since the issuance of Presidential Policy Directive
19 (PPD-19). This directive mandated that the Attorney General deliver a report to the
President within 180 days to assess the efficacy of the Department regulations that
implement the Whistleblower Protection Act (“WPA”) for Federal Bureau of
Investigation (FBI) employees.
Specifically, the provision states:
Within 180 days of the date of this directive, the Attorney General, in
consultation with the Special Counsel and Federal Bureau of Investigation
employees, shall deliver a report to the President that assesses the efficacy of
the provisions contained in part 27 of title 28, Code of Federal Regulations in
deterring the personnel practices prohibited in section 2303 of title 5, United
States Code, and ensuring appropriate enforcement of that section, and
describes any proposed revisions to the provisions contained in Part 27 of title
28 that would increase their effectiveness in fulfilling the purposes of section
2303 of title 5, United States Code. 1
This report was due by April 8, 2013. However, to date, there has been no public
announcement that the review has been completed. The report appears to be nearly ten
months overdue.
A comprehensive review is vital to correct the shortcomings of the FBI
whistleblower p rocess. For years, I have asked the FBI about whistleblowers such as
I lO n March 15, 2007, the Department’s Office of Inspector General found
tha l h vas retaliated against for pointing out fraudulent activities in the FBI.
The FBI appealed the Inspector General’s findings to Main Justice’s Office of A ttorn ey
Recruit ment and Management [OARM]. In 2009 and aoao, I asked you about l I
b nd the extremely lengthy amount of time OARM takes to make decisions. In
response to one of those questions, you replied on March 22, 2010: “OARM has been
Presidential Policy Direclive/PPD-19, Section E, p. 5 (Oct. 10, 2012).
conducting appropriate and necessary proceedings regarding
JRequest for
Corrective Action since it was filed in May 2006. Subject to a change in circumstances,
a ruling could be issued by OARM within the next several months.” Instead, OARM did
not issue the final ruling until more than three years later, on July 25, 2013.
|case is just one example that illustrates the dire need for a review of
28 C.F.R. Part 27 and a revision of the processes an FBI whistleblower has to follow in
order to be protected. Accordingly, please answer to the following questions:
1. What is the current status of your review pursuant to Section E of PPD-39?
2. Why have you failed to issue a report assessing the efficacy of 28 C.F.R. Part 27?
3. When will the report be complete?
4. When the report is complete, do you intend to provide it to the Judiciary
Committee? Why or why not?
Thanh you for your attention to this matter. I would appreciate a response by March
2014. Should you have any questions regarding this letter, please do not hesitate to
.1 I r _ _ __ _ . I I t l i_ n i
contactf
response.
of my Committee staff at
I look forward to your
b6
b7C
b6
b7C
b6
b7C
Sincerely,
Charles E. Grassley
Ranking Member
cc:
The Honorable James B. Comey, Jr., Director
Federal Bureau of Investigation
ALL FBI INFORMATION CONTAINED
HEREIN IS UNCLASSIFIED
DATE G3-03-2016 BY F22M45K35 :
Week of March 31 - April 4, 2014
Updated: March 31 , 2014 (8:00 a.m.)
Date Time Event Topic FBI
Participants
Other Contact
Participants
Tuesday,
April 1
1 1:00 a.m.
HPSCI Staff Briefing
Post 9/1 1 Terrorism
Financing
TBD
Friday,
April 4
9:00 a.m.
1-IPSCI Chairman and RiVl
Courtesy Visit
Courtesy Visit
DD Giuliano
N/A
Friday,
April 4
2:00 p.m.
Sen. Grasslcy Staff Briefing
National Insider Threat
Program
:d
N/A
DOJ:
ALL FBI' IHFtiiiATIDN COMTAIHIu
HESflN IS WCLASSiriEC
HATE 03-03-2016' BY I 2JH45K35 HSIOG
Week of JANUARY 27 - 31, 2014
Updated: January 29, 2014 (1:00 p.m.)
Date Time Event Topic FBI Other Contact
Participants Participants
Tuesday,
January 2S
8:00 a.m.
House Homeland Security
Committee Member
Briefing
TSC 101 and Redress
Procedures/Process
PDD Steven Mabeus
Director Piehota
TSAI | j
1 L
Tuesday,
January 28
9:00 a.m.
Senator Whitehouse-Guest
Speaker at FBI Cyber
Division All FJands
Conference
The Future of
Cybersecurity
DD Giuiiano
AD Demaresl
All Cyber Leadership
N/A
DOJ:
Wednesday,
January 29
10:00 a.m.
SSC1 Annual Threat
Assessment Hearing
Worldwide Threats
Director Comey
DNr Clapper
D/CIA Brennan
D1A
DOS
NCTC
DOJ:
Thursday,
1:30 p.m.
Briefing to HPSCI Staff
Security Clearance,
January 30
Insider Threat Reform
Thursday,
January 30
4:30 p.m.
Joint SSCI HPSC1 JRJG
Staff Briefing
Expansion of JRIG
Program
DADBrooks-SecD ,
NCIX
CD-TBD
DOJ: | ~
AD Velez-Villar
N/A
1 1
DOJ:
Attachments: OCA letter2.docx
SentinelCaseld: NON-RECORD
Classification: UNCLASSIFIED/ t^OUO —
i
b6
b7C
From: | 1
Sent: Wednesday, Februa ry 19, 2014 3:03 PM
To: I ~~l
Subject: Status Update re Proposed Insider Threat briefing
Hi □ - 1 just wanted to touch base with you and let you know that we offered the briefing to Grassley staff
regarding the Insider Threat program, but have not heard anything back yet; Til let you know if they do and
perhaps we can work out another date/tinie that will work for your schedule...
Let me know if you have any questions meantime.
Many th anks,
b6
b7C
1
HEREIN IS UNCLASSIFIED
From:
Sent:
To:
Subject:
SentinelCaseld:
](DO) (FBI)
BEERS, ELIZABETH RAE (OCA) (FBI)
Thursday. February 27, 2014 4:54 PM
|(DO) (FBI)
Kfc: New calendar item — UNCLASSIFIED
TRANSITORY RECORD
b6
b7C
Classification: UNCLASSIFIED
Did we ever schedule the briefing re the insider threat program?
FromQ
]DO) (FBI)
Sent: Thursday, February 27, 2014 4:49 PM
To: KELLY, STEPHEN (DO)(FBI); BEERS, ELIZABETH RAE (OCA) (FBI)|
tOCAl (FBlI
|(OCA) (FBI)I
E (DO)(FBI)
|DO)(FI
(DO)(FBI);C
>
FBI7TH
(DO)(FBI)[
3 (DO) (FBI)]
Subject: New calendar item — UNCLASSIFIED
Classification: UNCLASSIFIED
Jdo) (FBI)I
]. (DO) (FBI)£
1 (OCA) (FBI); ^
VDO) (FBI)
JOCA) (FBI);
b6
b7C
TRANSITORY RECORD
Calendar item:
Date and Time:
Event:
Committee/StalT:
Location:
Topic:
FBI Participants:
Other participants:
Classification:
OCA Contact:
OLA Contact:
March 1 1 , 20 1 4 at 1:30 pm
Briefing
Staff for Senate Judiciary Committee
TBD
Criminal History Records and Use of Non-Criminal/Justice/Civil Purposes
I D GC and| CJIS
SEARCH
] SEARCH
J Compact Council
Unclassified
b6
b7C
Classification: UNCLASSIFIED
Classification: UNCLASSIFIED.
l
b6
b7C
DO) (FBI)
From:
Sent:
To:
Subject:
I I DOJ (FBI)
Friday, February 28, 2014 11:03 AM
BEERS, ELIZABETH RAE (OCA) (FBI)
RE: New calendar item — UNCLASSIFIED
SentinelCaseld: TRANSITORY RECORD
Classification: UNCLASSIFIED
I extended to staffer a date and time for a briefing but they have not yet responded or accepted
From: BEERS, ELIZABETH RAE (OCA) (FBI)
Sent: Thursday, February 27, 2014 4:54 PM
To: I D PI (FBI)
Subject: RE: New calendar item — UNCLASSIFIED
Classification: UNCLASSIFIED
Did we ever schedule the briefing re the insider threat program?
From
Sent
£
bO) (FBI)
rhursday, February 27, 2014 4:49 PM
To: KELLY, STEPHEN (DO)(FBI); BEERS, ELIZAB ETH RAE (OCA) (FBI)l
(OCA) (FBI)j [ OCA) (FBI);| M (FBI)J
I l(DOXFBI)] l D O)(FBl)| K&OftFBIET
(DOXFBI)J
BCA) (FBI );|
(DO)(FBir
TC DOXFBDT
(DO) (FBI); |
Subject: New calendar item — UNCLASSIFIED
Classification: UNCLASSIFIED
immf
(UU) (FBl)j
(DO) (FBI)
lULA) (l-Bl);
b6
b7C
TRANSITORY RECORD
Calendar item:
Date and Time:
Event:
Committee/Staff:
Location:
Topic:
FBI Participants:
Other participants:
March 1 1 , 2014 at 1 :30 pm
Briefing
Staff for Senate Judiciary Committee
TBD
Criminal Histo ry Records and Use ofNon-Criminai/luslice/CivU Purposes
OGC and | HCJIS
]SEARCFI
| SEARCH
^Compact Council
b6
b7C
1
Classification:
OCA Contact:
OLA Contact:
Unclassified
b6
b7C
Classification: UNCLASSIFIED
Classification: UNCLASSIFIED
Classification: UNCLASSIFIED
2
(DO) (FBI)
From:
Sent:
To:
Cc:
Subject:
KELLY, STEPHEN (DO)(FBI)
Tuesday, December 24, 2013 12:49 PM
3 (CD)(FBI) , ;
BEERS, ELIZABETH RAE (OCA) (FBI) | D O) (FBI)
RE: Materials Responsive to Sen Grassley's Letter Re: Insider Threat —
UNCLASSIFIED/iTOIIO-
SentinelCaseld: NON-RECORD
b6
b7C
Classification: UNCLASSIFIED/ /"FOLIO —
Thank d I
I've included Beth anc | | , who can handle this when they return from the holidays.
Merry Christmas.
-Stephen
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
b6
b7C
Fmn l l (rnYFRT) “
Sent: Monday, December 23, 2013 2:04 PM
To: KELLY, STEPHEN (DO)(FBI)
Subject: Materials Responsive to Sen Grassley's Letter Re: Insider Threat — UNCLASSIFIED/ /FOUO
Classification: UNCLASSIFIED//TOtJ9-
AD Kelly -
I have a short paper and some materials prepared regarding Sen Grassley's letter regarding Insider Threat as it rota? •>*
whistleblowers. Is there a specific person in OCA through which I should coordinate?
Thanks,
UC
CD-417
b6
b7C
Classification: UNCLASS I FI ED //TOtJS—
l
SentinelCaseld: TRANSITORY RECORD
Classification: UNCLASSIFIED
TRANSITORY RECORD
b5
b6
b7C
Thanks,
Classification: UNCLASSIFIED
1
c
IDO) (FBI)
From:
Sent:
To:
Cc:
Subject:
P O) (FBI)
Monday, March 24, 2014 1 1:01 AM .
BEERS, ELIZABETH RAE (OCA) (FBI)!
(DO) (FBD I KDO)(FBI)|
KELLY, STEPHEN (DOHFBI 1
(OCA) (FBI)
RE: Calendar Items / IMS entries — UNCLASSIFIED
] (DO)(FBl£
, ])0)(FBI]_
J (DO) (FBI):|
b6
b7C
SentinelCaseld: TRANSITORY RECORD
Classification: UNCLASSIFIED
Beth,
Apologies for any confusion in our conversation earlier today.
I i was in an internal backbrief from the Insider Threat team
This was not on the Hill, it was internal FBI and informational.
v/r,
I 1
DO) (FBI)J
I (OCA) (FBI)f
TRANSITORY RECORD
From: BEERS, ELIZABETH RAE (OCA) (FBI)
Se nt: Monday, March' 24, 2014 10:53 AM
Tol | (DO)(FBI) J
(doxfhij
](DO) (FBI);
Cc: KELLY, S TEPHEN (DO)(FBI)
E DO) (FBI)
Subject: Calendar Items / IMS entries — UNCLASSIFIED
Classification: UNCLASSIFIED
DO) (FBI)[
for CLU 1.
b6
b7C
b5
b6
b7C
Thanks,
1
From:
Sent:
To:
Subject:
SentinelCaseld:
30) (FBI)
DO) (FBI)
t-ridav. ivtarcn 2b, 2U'I4 4 :ib pm
KELLY. STEPHEN (DOVFBI): BEERS ELIZABETH RAE (OCA) fFBhl 1
(DO)(FBI)j
PCA) (FBIL
KDO) O-BIU 1'
HlAt tFRII
rOCA) (FBIll 1 •
|
bOTFBTl
' ItUUHI-bl).
1
(UU)tFBII
bouFBnl i
/oca\ im \ —
1. (DO) (FBI): 1
~bO) (FBI);
1 IDO) (FBI)
Calendar items — UNCLASSIFIED
b6
b7C
TRANSITORY RECORD
Classification: UNCLASSIFIED
TRANSITORY RECORD
Calendar items:
Date and Time:
Event:
Committee/Staff:
Location:
Topic:
FBI Participants:
Other participants:
Classification:
OCA Contact:
OLA Contact:
April 4, 2014 at 2:00 pm
Briefing
Sen. Grassley staff
I-Iart 135
National Insider Threat Program
| UC, Counterintelligence Division 4.D (Insider Threat Investigation ■:
None
Unclassified
b6
b7C
Date and Time:
Event:
Committee/Staff:
Location:
Topic:
FBI Participants:
Other participants:
Classification:
OCA Contact:
OLA Contact:
April 8, 2014 at 2:30 pm
Hearing
Senate Judiciary
Dirksen 226
The Problem of Trade Secret Theft
Acting Assistant Director Louis Bladel. Counterespionage Section, Counterintelligence
Division
TBD
Unclassified
b6
b7C
Classification: UNCLASSIFIED
l
Subject: RE: Insider Threat presentation slide deck
It should be treated as P©WQ. but otherwise there is no problem in sharing.
Thanks,
tic l I
Counterespionage Section, FBIHQ.
Co-Director, National
Insider Threat Task Force
b6
b7C
1
ALL FBI INFORMATION COHTAUIHL
HEREIN IS UNCLASSIFIED
CATE 03-03-2016 BY F22M4 ! jK 35 tlSIL'S
From:
Kelly, Stephen
■ b6
b7C
Sent:
Mondav, April 14, 2014 4:30 PM
To:
kpll» CUonhonT f li iHiriam-Pon
i If.lnriiniarv-Rffnl
Cc:
Subject: Kt: information Assurance i raining - insiaer I nreat
Thanks.
- Stephen
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Federal Bureau of Investigation
b6
b7C
From: Kelly, Stephen
Se nt: Monday. Ap ril 14, 2014 4: 15 PM
To | IfJudiciarv-RepI Tjudiciarv-Repl b6
Subject: Information Assurance Training - Insider Threat
As we discussed, it appears that the information assurance training that the FBI requires for all employees includes a
"insider threat" section, along with numerous other sections. It's my understanding that this training is developed by
the Defense Information Security Agency and is available for you to review online at this link:
htto://iase.disa.mil/eta/cvberchallenee/launchPaRe.htm . As you can see at this link, this training has three versions for
DoD, Federal Agencies, and the Intelligence Community. I believe we use the federal agencies version, but I will confirm
that for you. As I mentioned to you, I apologize in advance because the format of the training is not particularly user
friendly for your purposes. You need to launch the program and then go through a step-by-step process to get to the
section on insider threat, which is a relatively small part of the overall training. This is the format that we have
internally, so we're not immediately able to provide it to you in another format. Also, as I mentioned, I have gone
through the insider threat piece, which includes several case examples and a series of exercises designed to identify
possible insider threat vulnerabilities, but I do not believe there is any mention of whistleblowers or their protections.
That being said, I wanted you to see it for yourself, and let me know if you have trouble accessing this link.
We will look further to see if there are other materials that may be responsive to your request, but I wanted to send this
along now as this training is provided to all employees, as well as the earlier DVDs that were provided earlier.
- Stephen
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Federal Bureau of Investigation
l
b7C
From:
Sent:
To:
Cc:
Subject:
| (Judiciary-Rep
Wednesday, April 16. 2014 1
Kelly SfenherL
Jjudiciary-Derrf
:bb AM
1 Judiciary-Rep)
RE: Information Assurance Trail In ly - msiuei imucu
Correction: It looks like we were able to access it on a second attempt.
From l I fJudiciarv-Rep)
Sent: Wednesday, April 16, 2014 10 :59 AM
To: ’Kelly, Stephen') hurlidarv-Repf
Cc:| | (Judiciary-Den^
Subject: RE: Information Assurance I raining - insider mreat
We cannot access the intelligence community version from the link you provided. It looks like you'll
need to figure out another way to get the relevant portion to us.
From: Kelly, Stephen [mailtol
Sent: Monday, April 14, 2014 4:30 PM
To: Kelly. Stephen J | Ju diciary-Rep);l I (Judiciary-Rep)
Cc: I lf Judiciarv-Dem) l I
Subject: RE: Information Assurance Training - Insider Threat
One correction. It appears that we use the Intelligence Community version of this information assurance training, which
includes sections on SCI procedures and working in SCIFs, which are not in the Federal Agencies version. This is the third
option on the link attached to the prior e-mail.
Thanks.
- Stephen
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Federal Bureau of In vestigation
b6
b7C
From: Kelly, Stephen
Se nt: Monday. Apr il 14, 2014 4: 15 PM
ToJ fJudiciarv-Rep l [ Judiciary-Rep)
Cf
Subject: inrormaiion assurance i raining - insiaer i meat :
b6
b7C
As we discussed, it appears that the information assurance training that the FBI requires for all employees includes a
"insider threat" section, along with numerous other sections. It's my understanding that this training is developed by
the Defense Information Security Agency and is available for you to review online at this link:
http://iase.disa.mil/eta/cvberchallenKe/launchPaRe.htin . As you can see at this link, this training has three versions for
DoD, Federal Agencies, and the Intelligence Community. I believe we use the federal agencies version, but I will confirm
b6
b7C
b6
b7C
1
that for you. As I mentioned to you, I apologize in advance because the format of the training is not particularly user
friendly for your purposes. You need to launch the program and then go through a step-by-step process to get to the
section on insider threat, which is a relatively small part of the overall training. This is the format that we have
internally, so we're not immediately able to provide it to you in another format. Also, as I mentioned, I have gone
through the insider threat piece, which includes several case examples and a series of exercises designed to identify
possible insider threat vulnerabilities, but I do not believe there is any mention of whistleblowers or their protections.
That being said, I wanted you to see it for yourself, and let me know if you have trouble accessing this link.
We will look further to see if there are other materials that may be responsive to your request, but I wanted to send this
along now as this training is provided to all employees, as well as the earlier DVDs that were provided earlier.
- Stephen
Stephen D. Kelly
Assistant Director
Office of Congressional Affairs
Federal Bureau of Inv estigation
b6
b7C
2
b6
b7C
From: I ~l
Sent: Thursday, January 30, 2014 12:35 PM
To: | | Judiciary-RepY
Subject: RE: Letter re Insider threat videos
I should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details,
Thanks
Frorru
(Judiciary-Rep) fmailtq
Se nt: Wednesday. January 29. 2 014 3:49 m -
To: I , , I
Subject: RE: Letter re Insider threat videos
i lave you been able to find an answer to this question?
Thank, you.
b6
b7C
Investigative Counsel
Ranking Member Charl.es E. Grassley
1 1 «s Si'nni.' r'nminiiiw on the Judieiai’y
FrnrH ~l(li irliriary-Rpp)
Sent: Thursday, January 09, 2014 2:39 PM
To l I
Subject: RE: Letter re Insider threat videos
Thank you for the very prompt response to Senator Grasslcy's letter. 1 just got back in the office yesterday alter being out
on paternity leave, and received the videos then. However, I did want to just check — docs this-incan that there are no
other training materials regarding the National-Insider Threat Program or any FBI-specific insider threat program?
Thanks,
Investigative Counsel
Ranking Member Charles E. Grassley
U.S. Senate Committee on the Judiciary
1
b6
b7C
b6
b7C
Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013.
2
A company can often detect or control when an outsider (non-employee) tries to access company
data either physically or electronically, and can mitigate the threat of an outsider stealing
company properly. However, the thief who is harder to detect and who could cause (he most
damage is the insider— the employee with legitimate access. That insider may steal solely for
personal gain, or that insider may be a "spy ” — someone who is stealing company information or
products in order to benefit another organization or country.
The Insider Threat
An introduction to delecting and deterring an. insider spy.
View printable version ftxlO
This brochure serves as an introduction for managers and security personnel on how to detect
an insider threat and provides tips on how to safeguard your company 's trade secrets.
Protect Your Intellectual Property
of intellectual properly is an increasing threat to organizations,
and can go unnoticed for months or even years.
There are increased incidents of employees taking proprietary information when they believe
they will be, or are. searching for a new job.
Congress has continually expanded and strengthened criminal laws for violations of intellectual
property rights to protect innovation and ensure that egregious or persistent intellectual property
violations do not merely become a standard cost of doing business.
A domestic or foreign business competitor or foreign government intent on illegally acquiring a
company's proprietary information and trade secrets may wish to place a spy into a company in
order to gain access to non-public information. Alternatively, they may try to recruit an existing
employee to do the same thing.
Personal Factors
There are a variety of motives or personal situations that may increase
t. '< xelihoocl sot" me will spy against their employer:
Greed or Financial Need: A belief that money ean fix anything. Excessive debt or overwhelming
expenses.
Anger/Reven •< Disgruntlement to the point of wanting to retaliate against the organization.
Prob'ems at work: . lack of recognition, disagreements with co-workers or managers,
dissatisfaction will the job, a pending layoff.
Ideology/Identificalion: A desire to help the "underdog” or a particular cause.
Divided LoyalW: Allegiance to another person or company, or to a country besides the United
Stales.
Adventure/Thrill: 'Vant to add excitement to their life, intrigued by the clandestine activity,
"James Bond Wannabe."
Vulnerability to blackmail: Extra-marital affairs, gambling, fraud.
Ego/Self-image: An "above the rules” attitude, or desire to repair wounds to their self-esteem.
Vulnerability to flattery or the promise of a better job. Often coupled with Anger/Revenge or
Adventure/Thrill.
Ingratiation: A desire to please or win the approval of someone who could benefit from insider
information with the expectation of returned favors.
Compulsive and destructive behavior: Drug or alcohol abuse, or other addictive behaviors.
Family problems: Marital conflicts or separation from loved ones.
Organization a 1 Facto rs
Organizational situations may increase the ease for thievery:
The availab l\ «; \ ease of acquiring proprietary, classi fied, or other protected materials.
Providing access nr\ Ut < - to those who do not need it.
Proprietary or c ; . .1 . •. irmation is not labeled as such, or is incorrectly labeled.
The ease that soiru ..... may exit the facility (or network system) with proprietary, classified or
other protected materials.
I mdefincd policies •egarding working from home on projects of a sensitive or proprietary nature.
Time pressure: hmpioyees who are rushed may inadequately secure proprietary or protected
materials, or ■ fully consider the consequences of their actions.
T r.ployees , • * t 'ned on how to properly protect proprietary information.
Behavioral Indie . tors
Some behaviors tv } he a clue that an employee is spying and/or methodically stealing from the
organization •
home via documents, thumb drives, computer disks, or e-mail. Inappropriately seeks or obtains
proprietary or classified information on subjects not related to their work duties.
I Merest in maltei. Mside the scope of their duties, particularly those of interest to foreign
entities or Iv ;.,es competitors.
1 ecc »atily copies material, especially if it is proprietary or classified.
Remotely accesses the computer network while on vacation, sick leave, or at other odd times.
Disregards com pa v computer policies on installing personal software or .hardware, accessing
restricted website- conducting unauthorized searches, or downloading confidential information.
' • ks odd hours mout authorization; notable enthusiasm for overtime work, weekend work,
oi unusual schedules when clandestine activities could be more easily conducted.
Unreported foreign contacts (particularly with foreign government officials or intelligence
officials) or unreporled overseas travel.
Short trips to foreign countries for unexplained or strange reasons.
1 ncxplained afllu 1 ; buys tilings that they cannot afford on their household income.
hngnges in suspicious personal contacts, such as with competitors, business partners or other
unawbonzed individuals.
( <verv. ned b> 1 fe crises or career disappointments.
Shows unusual ini* r. in the personal lives of co-workers; asks inappropriate questions
regarding finances > elationships.
Concern that they are being investigated; leave straps to detect searches of their work area or
home: searches lor listening devices or cameras.
Many people experience or exhibit some or all of the above to varying degrees; however, most
people will not cross the line and commit a crime.
You Can Make A Difference
Organizations need to do their part to deter intellectual property theft:
« Educate and regularly train employees on security or other protocols.
® Ensure that proprietary information is adequately, if not robustly, protected.
» Use appropriate screening processes to select new employees,
o Provide non-threatening, convenient ways for employees to report suspicions.
» Routinely monitor computer networks for suspicious activity.
• Ensure security (to include computer network security) personnel have the tools they
need.
Remind employees that reporting security concerns is vital to protecting your company’s
intellectual property, its reputation, its Jinancial well-being, and its future. They are protecting
their own jobs. Remind them that if they sec something, to say something.
Get Assistance
Being aware of potential issues, exercising good judgment, and conducting discrete inquiries will
help you ascertain if there is a spy in your midst. However, if you believe one of your employees
is a spy or is stealing company trade secrets, do not alert the person to the fact that he/she is
under suspicion, but seek assistance from trained counterintelligence experts-such as the FBI.
The FBI has the tools and experience to identify and mitigate such threats. If asked to
investigate, the FBI will minimize the disruption to your business, and safeguard your privacy
and your daia. Where necessary, the FBI will seek protective orders to preserve trade secrets and
business confidentiality. The FBI is committed to maintaining the confidentiality and
competitive position of US companies. The FBI will also provide security and
counterintelligence training or awareness seminars for you and your employees upon request.
Recent Insider Theft Cases
Won C'hyu Liu, a retired research scientist, was sentenced in January 2012 to 60 months in
prison, two years supervised release, a $25,000 fine and was ordered to forfeit $600,000. Liu was
convicted in February 201 1 of stealing trade secrets from his former employer and selling them
to companies in China Liu conspired with at least four current and former employees, traveled
throughout China to market the stolen information, paid current and former employees for
material and information, and bribed a then-employee with $50,000 in cash to provide a process
manual and other information.
Kcxuc Huang was employed by two different US companies. He admitted that from 2007 to
2010 he delivered stolen trade secrets from both companies to individuals in Germany and
China. The stolen materials were used to conduct unauthorized research to benefit Chinese
universities. Huang also pursued steps to develop and produce the trade secrets in China. The
aggregated loss from both companies was between $7 and $20 million. Huang pleaded guilty to
charges of economic espionage and theft of uadc secrets, and was sentenced in December 201 1
to 87 months in prison and three years supervised release.
Yuan Li, a former research chemist with a global pharmaceutical company, pleaded guilty in
January 2012 to stealing her employer’s trade secrets and making them available for sale through
Abby Pharmntech. [no. Li was a 50% partner in Abby. Between October 200S and June 2011 Li
accessed her employer's internal databases, downloaded information to her personal home
c iinpuler. and made them for sale through Abby. She was sentenced to 1 8 months in prison.
Elliot Doxcr sem an e-mail to the Israeli Consulate stating that he was willing to provide
infomiation from his employer that might help Israel. An undercover FBI agent posing as an
Israeli intelligence officer spoke to Doxer and established a "dead drop” where the two could
exchange information. For the next 1 8 months. Doxer visited the dead drop at least 62 times.
Doxcr jrovided customer and employee lists, contract information, and other trade secrets. He
pleaded guilty to ooe count of foreign economic espionage and was sentenced in December 201 1
ro six months in prison, six months home confinement, and fined $25,000.
.Sergev Mcynikov worked as a computer programmer fora Wall Street company. During his last
lew days a* mar company, he transferred 32 megabytes of proprietary computer codes — a theft
that could have eo>i nis employer millions ofdollars. He attempted to hide his activities but the
company discovered irregularities through its routine network monitoring systems. In December
2 >10. Aleynikov was found guilty of theft of trade secrets.
Michael Mitchell became disgruntled and was fired from his job due to poor performance. He
kept numerous computer files with his employer’s trade secrets; he entered into a consulting
agreement with a rival Korean company and gave them the stolen trade secrets. In March 2010,
he was sentenced in 1 8 months in prison and ordered to pay his former employer over $1 87,000.
S ha I in .1 leweri gm o trade secrets to a person he believed was an investor willing to finance a
business venture in India, and confirmed that the information he had taken from his employer
w as eve w thing he needed to start the business. In January 2011, he was sentenced to time served
tone year and fifteen days), three years probation, a$5,000 fine, and a $ 1 00 Special Assessment.
i , uni ujtt .fiii uk 1. t k ave of absence from her US employer in 2006. While on leave, Jin worked
lot a similar company in China. A year later. Jin returned to the United States. Within a week of
her teut.n. she bough’, a one-way ticket back to China, and advised her US employer that she was
roam to end her le ive. Jin returned to work on February 26, 2007 and for the next two days
downloaded hundreds of technical documents. On February 2S, 2007, during a routine check at
tnc airport, more than 1 .000 electronic and paper documents proprietary to her US employer
\,uv fou.ul in Jin's luggage, In 2012. Jin was sentenced to four years in prison and fmed$20,000.
Greg Chung spied lor China from 1979-2006. Chung stole trade secrets about the space shuttle,
the Delta IV rocket and the C-17 military cargo jet for the benefit of the Chinese government.
Chung's motive was to "contribute to the Motherland.” He stole hundreds of thousands of
documents from his employer. He traveled to China under the guise of giving lectures while
secretly meeting with Chinese agents. He also used Mak (below) to transfer information back to
China. In February 2010 he was sentenced to over 15 years in prison.
Chi Mak admitted that he was sent to the United States in 1978 in order to obtain employment in
the defense industry with the goal of stealing US defense secrets, which he did for over 20 years.
He passed information on quiet electric propulsion systems for US submarines, details on the
Aegis radar system, and information on stealth ships being developed by the US Navy. The
Chinese government tasked Mak to acquire information on other technologies. Mak recruited
family members to encrypt and covertly courier information back to China. In May 2007, Mak
was convicted of conspiracy, failing to register as an agent of a foreign government, and other
violations. He was sentenced to over 24 years in prison.
Report theft of trace secrets to your local FBI office or submit a tip online: tios.foi.gov
Event Date:
Congressional Affairs Office
Congressional Contacts
Classification Level: (Unclassified
Date
Entered:
C Briefing
Brief Typo:
03712/2014 J2014-600 L
O Hearing Q SACCV O HQCV O FOC
Event Date: J 3/12/2014 Event Time:
Mother * If of SACCV r
J Visits: '
Unit: |CLU II
Entered By: J 7 " I
Topic - Acknowledgement from Grassley staffe[ |uuu u= uiu
^ ’ not respond to FBI's offer more than a month ago for a briefing on
the matter of Insider Threat program, and request for a briefing.
]that he did Division: F
briefina on >
OCA Contact \
Person: *
b6
b7C
DOJ Contact:
Date:
Attended:
FBI
Participants:
Other Participants:
Committees
/Subcommittees
Members/Staff:
Grassley staffer
Executive Summary:
I I re Insider Threat program brieing
Details of Event:
Acknowledgement from Grassley staffer I t hat he rlirl not respond to FBI's offer more than a month ago
for a briefing on the matter of Insider Threat program. Agent enewed the offer of a briefing. | |
agreed. Will follow up with prospective date/time.
Follow Up Action:
Attachment:
b6
b7C
b6
b7C
0
From:
Sent:
To:
Subject:
Friday. February 07, ?nia 3-3R pm
f (Judiciary-Rep)'
RE: Letter re Insider threat videos
K following up on a short voicemail I left a moment ago - it looks like a briefing may best answer your
questions on the subject, so perhaps we could coordinate something for the week of the 24 th ; let me know
how that works and we'll see what we can line up
Thanks,
From j P udiciary-Rep) f mailto
Sen t: Thursday, February 06, 201 4 11:06 AM
To: I I
Subject: RE: Letter re Insider threat videos
Wiial were you able to learn? I never heard back from you last week.
Thanks,
From: ! tnailtoj^
Sent: Thursday, January 30, 2014 12:35 PM
To J l (Judiciary-Rep)
Subject: RE: Letter re Insider threat videos
I should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details,
Thanks
From j I (Judiciary-Rep) f imailh
Se nt: Wednesday, January 29. 2014 3:49 Ph
T ° i i
Subject: RE: Letter re Insider threat videos
I lave you been able to find an answer to this question?
Thank you.
Investigative Counsel
l
Ranking Member Charles E. Grassley
U-S. Senate Commi ttee on ihc Judiciary
](Judiciary-Rep)
From
Se nt; Thursday, January 09. 701 4 7; 3Q pm
T o:
Subject: Kt: Letter re insider threat videos
b6
b7C
Thank you for Ihc very prompt response to Senator Grassley's letter. I just got back in the office yesterday al'lcr being out
on paternity leave, and received the videos then. However, I did want to just check— docs this mean that there arc no
other training materials regarding the National Insider Threat Program or any R13l-spccific insider threat program?
Thanks.
I I
Investigative Counsel
Ranking Member Charles E. Grassley
U.S. Senate Comm
ttee on the Judiciary
b6
b7C
Fromf
Sent: ;
To{—
fmailtg
uesaav, Dece mber 31. 2(H3 2:29PFI
[Judiciary-Rep); CEG (Judiciary-Rep)
Subject: Letter re Insider threat videos
Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013.
2
From:
Sent:
To:
Subject:
I f Judiciary-Rep) |
Wednesday. March 1 ? ?t)14 3 :h4 hm
Kt: Letter re insider tnreat videos
b6
b7C
Thanks for looking into updated briefing dales, and 1 apologize I never got back to you on this before. Again, to reiterate
Senator Grassley's request, if there are any additional training materials on tbc Insider Threat Program, whether intended
FRI-specific or intended for the training of other agencies through the National Insider Threat Program, we woidd like
those to be produced to the Committee (both majority and minority). If the briefer would like to walk us through such
materials, that would be great, but any bricling would be most helpful in the context of the materials themselves.
Best.
1 b6
b7C
Investigative Counsel
Ranking Member Charles Is, Grassley
U.S. Senate Committee on the Judiciary
From
Sent:
To[
mailtcQ
Friday, February 07, ’2014 3:58 PM
|(Judiciary-Rep)
Subject: RE: Letter re Insider threat videos
b6
b7C
| following up on a short voicemail I left a moment ago - it looks like a briefing may best answer your
questions on the subject, so perhaps we could coordinate something for the week of the 24 th ; let me know
how that works and we'll see what we can line up
Thanks,
fmailtc
:06 AF"
Frorr j l (Judiciary-Rep)
Se nt: Thursday, February 06, 201 4 11
To: l I
Subject: RE: Letter re Insider threat videos
Wluu were you able to learn? I never heard back from you last week.
Thanks.
b6
b7C
From
mailto
Sent; Thursday, January 30, 2014 12:35 PM
l
T q C Judiciarv-RepI
Subject: RE: Letter re Insider threat videos
b6
b7C
|-|
i should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details,
Thanks
From:^ | (Judiciary-Rep) r mailtcT
Sent: Wednesday, January 29, 2014 3:49 PM
To j I
Subject: RE: Letter re Insider threat videos
b6
b7C
Have you been able to Intel an answer to this question?
Thank you.
investigative c ounsel
Ranking Member Charles li. Grassley
U.S. Senate Committee on the Judiciary
From | ~| Judiciary-Rep)
Sent: Thursday, January 09, 2014 2:39 PM
To H I
Subject: RE: Letter re Insider threat videos
I b6
Thank you lor the very prompt response to Senator Grassley's letter. I just got back in the office yesterday after being out b7c
on paternity leave, and received (lie videos then. However, I did want to just check — docs this mean dial there are no
other training materials regarding the National Insider Threat Program or any FBI-specific insider threat program?
I hanks.
Investigative Counsel
Ranking Member Charles H. Grassley
U.S. Senate Committee on the Judiciary
From
Se nt: Tuesday, Dec ember 31, 2013 2:29
FT
(Judiciary-Rep); CEG (Judiciary-Rep)
To:
Subject: Letter re Insider threat videos
b6
b7C
2
Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013.
3
United States Semite
, .* t M>' . { *, ilr! t - 1|i ft I"
./A* «f V i f «* *.K 5'- * .V*
December 17, 2013
VTA ELECTRONIC TRANSMISSION
The Honorable James B. Comey, Jr.
Director
Federal Bureau oflnvesligalion
935 Pennsylvania Avenue, N.W.
Washington, DC 20535
Dear Director Comey:
On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation
(FBI) in which it indicated that it had collaborated with the Office of the Director of
National Intelligence (ODNI) on two training videos about the FBI’s National Insider
Threat Program. The videos, titled Betrayed and Game of Pawns,, were developed
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National
Counterintelligence Executive (ONCIX). The FBI has also produced other insidei thieat
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and
Deterring an Insider Spy. 1
As I understand it, the National Insider Threat Program is the result of Executive
Order 13587, issued by President Obama in October 2011, which established an
interagency Insidei 1 Threat Taslc Force, to be staffed by the FBI and the ONCIX. 2 It also
directed Executive Branch departments and agencies to develop their own insider threat
programs. The President subsequently issued a Presidential Memorandum in
November 2012 transmitting the National Insider Threat Policy and setting forth
minimum standards for departmental and agency programs.^
These efforts have subsequently received press attention, some of which has
focused on concerns about whether the program adequately protects whistleblowers.* 1
' Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an
Insider Spy, http://vvww.n3i.gov/ab0uL-us/investigate/ countcrintelligenec/insidcrJ:hreat_brochure.
- Executive Order 13587 — Structural Reforms to Improve the Security of Classified Networks and the
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at.
http://www.whitehouse.gov/the-press-office/2011/ to/ 07/exeeutivc-ordcr-struetural-rcforms-irn prove-
sccurity-classified-neLworks-.
.1 presidential Memorandum — National Insider Threat Policy and Minimum Standards for Executive
Branch Insider Threat Programs, Nov. 21, 2012. Available at. http://vvww.whitchouse.gov/thc-press-
office/20 12/11/2 i/prcsidential-memorandum-national-insider-thrcat-policy-and-minimum-stand.
•1 l’or example, Marisa Taylor and Jonathan S. handay, "Obama's crackdown views leaks as aiding enemies
of U.S.," McClatcliy (Jun. 20, 2013), available at
The Honorable James 13 . Comey, Jr.
December 17, 2013
Page 2 of 2
As you know, I strongly Relieve that whistleblowers play an important role in
safeguarding the federal government against waste, fraud, and abuse. You too stated in
your confirmation hearing that you believe whistleblowers are a critical element of a
functioning democracy. Their willingness Lo come forward contributes to improving
government operations. They often pul themselves at risk of reprisal from their
employers, sometimes being demoted, reassigned, or fired as a result of their actions.
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal
employees may nol be retaliated against for reporting waste, fraud, and abuse. s
Accordingly, some agencies have taken steps to prevent the insider threat
program from chilling whistleblower communications. For example, the Office of the
Inspector General for the Intelligence Community is developing training that integrates
whistleblowing into the agency processes, making the Intelligence Community'
whistleblowing and insider threat programs mutually reinforcing.
hi order to assess whether, training materials on the National Insider Threat
Program provide adequate guidance on protecting whistleblowers, I respectfully request
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of
any other training materials regarding the National Insider Threat Program or any FR 1 - -
specific insider threat program.il would appreciate receiving these materials by January
14, 2014. 1 know that you consider transparency to be an important value, and I trust
that transparency on this issue will benefit both whistleblowers and our national
security.
Should you h ave any questions regarding this letter, please contact]
I | f my staff at ~~1
b6
b7C
Sincerely,
1
Charles E. Grassley
Ranking Member
cc: The Honorable James R. Clapper
Director of National Intelligence
hllp://ivww. mcclaLehycle.com/20i3/06/20/1945 i 3 /obcimas-cracl«lown-views-leaks-as.htin]#.lJccy--
vmVHl,
5 Presidential Policy Directive 19, The White House, October 10, 2012.
From:
Sent:
To:
Subject:
[
(Judiciary-Rep) I
I hursdav. JanuarvQ9. 2014 nui
RE: Letter re insider threat videos
b6
b7C
Thank you for the very prompt response to Senator Grass ley's letter. I just got back in the office yesterday after being out
on paternity leave, and received die videos then. However, I did want to just cheek — does this mean that there are no
other training materials - regarding die National Insider Threat Program or any FBi-spccific insider threat program?
flianks.
b6
b7C
From:
fmailto^
Sent: Tuesday, December 31, 2013 2:29 PM
To: | | Qudiciary-Rep); CEG (Judiciary-Rep)
Subject: Letter re Insider threat videos
Letter from FBI, response to Sen. Grassley’s of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013.
l
ALL INFORMATION CONTAINED
HEREIN IS UNCLASSIFIED
DATE 03-03-201 6 EY F22M45K35 NS ICG
Congressional Affairs Office
Congressional Contacts
Event Date: j 1/30/2014
Classification Level:
Unclassified
Date
Entered
j 2014-522.
@ Proactive
Reactive
O Briefing
O Hearing Q SAC CV Q HQ CV
O FOC
® Other
it of sac cv r
Visits: '
0
Brief Type: j
j Event Date: j
1/30/2014
Event Time:
■
.
Entered By:
Unit: JcLU II
Topic: i® en ' G fass ley staffer ! 1 inquiry re status of any
ladditional Insider Threat training details.
Division:
OCA Contact | | ' ' ' ' ‘ ‘
Person: 1- ’^
DOJ Contact: J Date; J Attended: [
FBI “
Participants:
Other Participants:
Committees
/Subcommittees
b6
b7C
Members/Staff: *Sen. Grassley staffer
Executive Summary:
Sen. Grassley staffer
inquiry re status of any additional Insider Threat training details.
Details of Event:
Sen. Grassley staffer ! “I nquiry re status of any additional Insider Threat training details. Advised staffer
■that additional details may be available, will get back when/if any available.
Follow Up Action:
b6
b7C
Attachment:
IS UNCLASSIFIED
-03-2016 BY F22M45K35 KSIC
Congressional Affairs Office
Congressional Contacts
Event Date: j -
2/7/2014
Classification Level:
Unclassified
Date
Entered:
tpy Proactive
! [_ ;p2/07/20ffi r T ] 2014-552
'O Briefing O Hearing O SAC CV Q HQ CV O FOC (-/Other
Reactive
J
It Of SAC CV
Visits:
Brief Type:
Entered By£
Event Date: J~
2/7/2014
Unit: jcLU II
Event Time:
T 0 pj c: | Slens lj> coordinate briefing for Sen. Grassley stafferj
OCA Contact
Person:
e Insider Threat program training
,[
Division:
■r
DOJ Contact:
FBI
Participants:
Other Participants:
Committees
/Subcommittees
Date:
•r
Attended:
b6
b7C
Members/Staff:
Istaffer for Sen. Grassley (IA)
Executive Summary:
Steps to coordinate briefing for Sen. Grassley staff d I re Insider Threat program training
Details of Event:
Steps to coordinate briefing for Sen. Grassley staffe |re Insider Threat program training. Questions
that staffer has do not lend themselves to yes or no answers, so briefing in the format of a Q&A is proposed to
staffer through the CD-4D unit.
Follow Up Action:
Attachment:
0
b6
b7C
Congressional Affairs Office
Congressional Contacts
Event Date: j 4/16/2014 classification Level
^04/16/2014- < 2014-627
Unclassified
Date
Entered:
;l ; Briefing
Brief Type:
Entered By:
ftj) Proactive
©
Reactive
i. 5 SAC CV O HQ CV
t J FOC
(»/ Other
Event Date: J
4/16/2014
Event Time:
It of SAC CV [
Visits: '
Unit: jdU II
Topic - Gf assley staffe j j e insider threat video training access link Division: T
sent by AD Kelly J
iby
OCA Contact
Person:
DOJ Contact:
FBI
Participants:
Other Participants:
Committees
/Subcommittees
Date
Attended:
b6
b7C
Members/Staff:
Grassley staffer
Executive Summary:
Grassley staffer ) | re insider threat video training access link sent by AD Kelly.
Details of Event:
Gras sley staff er l I re Defense Information Security Agency insider threat video training access link sent by AD
Kelly l j claimed unable to access, then later acknowledged ability to access link on computer.
Follow Up Action:
Attachment:
b6
b7C
b6
b7C
0
Live Music
Archive
Librivox
Free Audio
Metropolitan Museum
Cleveland
Museum of Art
Internet
Arcade
Console Living Room
Open Library
American
Libraries
TV News
Understanding
9/11